~ / search / GHSA-wcx3-63mm-h8x6

GHSA-wcx3-63mm-h8x6

MediaWiki UnlinkedWikibase Cross-site Scripting vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2024-34500

Packages

EcosystemPackageAffectedFixed in
Packagist samwilson/unlinked-wikibase < 1.42.0 1.42.0

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.42.0. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.

References

External links from the advisory. They lead to third-party sites.