Code injection

2024-01-1205:15:00

PRIOn knowledge base

www.prio-n.com

security

code injection

xss

mediawiki

6.2 Medium

AI Score

Confidence

High

0.0004 Low

EPSS

Percentile

14.2%

JSON

An issue was discovered in the CheckUser extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via message definitions. e.g., in SpecialCheckUserLog.

CPENameOperatorVersion
mediawikilt1.35.14
mediawikige1.36.0
mediawikilt1.39.6
mediawikige1.40.0
mediawikilt1.40.2

Name	Operator	Version
mediawiki	lt	1.35.14
mediawiki	ge	1.36.0
mediawiki	lt	1.39.6
mediawiki	ge	1.40.0
mediawiki	lt	1.40.2

References

gerrit.wikimedia.org/r/c/mediawiki/extensions/CheckUser/+/989179

phabricator.wikimedia.org/T347708