Input validation

2020-02-2423:15:00

PRIOn knowledge base

www.prio-n.com

5.6 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

21.6%

JSON

An issue was discovered in the Widgets extension through 1.4.0 for MediaWiki. Improper title sanitization allowed for the execution of any wiki page as a widget (as defined by this extension) via MediaWiki’s {{#widget:}} parser function.

CPENameOperatorVersion
widgetsle1.4.0

CPE	Name	Operator	Version
	widgets	le	1.4.0

References

gerrit.wikimedia.org/r/q/I953e060bc6994ffdba9f380c98173f53f8ca1ea8

phabricator.wikimedia.org/T245850