Cross-Site Scripting Vulnerability in MediaWiki's WatchAnalytics Extension
CVE-2024-23177

6.1MEDIUM

Key Information:

Vendor

MediaWiki
Status
WatchAnalytics Extension
Vendor
CVE Published:
12 January 2024

What is CVE-2024-23177?

A vulnerability has been identified in the WatchAnalytics extension for MediaWiki versions prior to 1.40.2, allowing attackers to exploit the Special:PageStatistics page parameter. This exploitation can lead to Cross-Site Scripting (XSS), enabling malicious scripts to be executed in the context of a user's session, compromising their data and privacy. Users are advised to update to the latest version to mitigate this vulnerability.

References

https://lists.wikimedia.org/hyperkitty/list/mediawiki-ann...
https://phabricator.wikimedia.org/T348979

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.