GHSA-fmrf-p77g-vv5c

MediaWiki Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2023-37302

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	wikibase/wikibase	<= 1.39.3	no fix listed

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a title attribute).

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2023-37302 advisory
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933649 web
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933650 web
https://github.com/wikimedia/mediawiki package
https://phabricator.wikimedia.org/T339111 web