BIT-mediawiki-2024-23179

vendorUSosv

view advisory published 2024-03-06Licence: per source

An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2. For a Special:GlobalBlock?uselang=x-xss URI, i18n-based XSS can occur via the parentheses message. This affects subtitle links in buildSubtitleLinks.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2024-23179US	medium6.1	0.43% (37th)	—	2024-01-12
An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2. For a Special:GlobalBlock?uselang=x-xss URI, i18n-based XSS can occur via the parentheses messag…

references

External citations — patches, advisories, analysis.

https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce%40lists.wikimedia.org/message/TDBUBCCOQJUT4SCHJNPHKQNPBUUETY52/WEB
https://nvd.nist.gov/vuln/detail/CVE-2024-23179WEB
https://phabricator.wikimedia.org/T347746WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan