XSS Vulnerability in GlobalBlocking Extension for MediaWiki
CVE-2024-23179

6.1MEDIUM

Key Information:

Vendor

Mediawiki
Status
Mediawiki
Vendor
CVE Published:
12 January 2024

What is CVE-2024-23179?

A vulnerability has been identified in the GlobalBlocking extension for MediaWiki that allows for internationalization-based cross-site scripting (XSS) attacks. Specifically, when accessing a specially crafted URI (Special:GlobalBlock?uselang=x-xss), an attacker can manipulate the parentheses message resulting in malicious code execution. This flaw affects the subtitle links generated by the buildSubtitleLinks function, potentially compromising user interactions and data integrity within the affected MediaWiki instances prior to version 1.40.2.

References

https://lists.wikimedia.org/hyperkitty/list/mediawiki-ann...
https://phabricator.wikimedia.org/T347746

CVSS V3.1

Score:
6.1
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Changed

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.