XSS Vulnerability in WikiDiscover Due to Unescaped Interface Messages

CVE-2024-25107

What is CVE-2024-25107?

The WikiDiscover extension used in CreateWiki manages wikis but has a vulnerability within the Language::date function. This function processes human-readable timestamps and utilizes unescaped interface messages. Because the output is not properly sanitized, this flaw enables the injection of malicious scripts, leading to a Cross-Site Scripting (XSS) vulnerability. For exploitation on wikis, the (editinterface) permission is required. Users must update to the latest version as outlined in commit 267e763a0, as there are currently no workarounds for this issue.

References