CVE-2023-37302

2023-06-3017:15:09

Google

osv.dev

cve-2023-37302

mediawiki

xss

wikibase

sitelinksview.php

title attribute

lack of escaping

quotes

6.1 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

5.8 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

25.1%

JSON

An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a title attribute).

CPENameOperatorVersion
mediawikieq1.39.0
mediawikieq1.39.2
mediawikieq1.5.0beta2
mediawikieq1.39.0-rc.1
mediawikieq1.5.0beta4
mediawikieq1.5.0alpha1
mediawikieq1.39.3
mediawikieq1.5.0beta3
mediawikieq1.39.1
mediawikieq1.6.0

Name	Operator	Version
mediawiki	eq	1.39.0
mediawiki	eq	1.39.2
mediawiki	eq	1.5.0beta2
mediawiki	eq	1.39.0-rc.1
mediawiki	eq	1.5.0beta4
mediawiki	eq	1.5.0alpha1
mediawiki	eq	1.39.3
mediawiki	eq	1.5.0beta3
mediawiki	eq	1.39.1
mediawiki	eq	1.6.0