Code Injection Vulnerability in Mediawiki - CSS Extension

CVE-2024-47845

Summary

A vulnerability has been identified in the Mediawiki - CSS Extension, which arises from improper encoding or escaping of output. This security flaw could allow an attacker to inject malicious code into web applications utilizing the affected extension. Versions of the Mediawiki CSS Extension prior to 1.39.9, 1.41.3, and 1.42.2 are vulnerable, posing significant risks to application integrity and overall user security. It is crucial for organizations using these versions to apply the necessary updates and safeguards to mitigate potential exploitation.

References