Описание
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Language/mediawiki.Language.Js.
This issue affects MediaWiki: from * before 1.39.15, 1.43.5, 1.44.2.
A flaw was found in MediaWiki. This vulnerability, known as Cross-site Scripting (XSS), occurs due to improper neutralization of input during web page generation. A remote attacker could exploit this by injecting malicious scripts into web pages. Successful exploitation could lead to arbitrary code execution in the user's browser, information disclosure, or session hijacking.
Отчет
This stored cross-site scripting (XSS) vulnerability in MediaWiki, affecting Fedora 42 and Fedora 43, allows an attacker to inject malicious scripts. These scripts can then be executed in the context of other users' browsers due to improper input neutralization during web page generation.
Меры по смягчению последствий
To mitigate this issue, restrict network access to the MediaWiki instance to only trusted users and networks. Implement firewall rules to limit inbound connections to the MediaWiki server. Additionally, ensure that only trusted and authorized users are granted permissions to contribute or edit content within the MediaWiki environment.
Дополнительная информация
Статус:
EPSS
4.6 Medium
CVSS3
Связанные уязвимости
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Language/mediawiki.Language.Js. This issue affects MediaWiki: from * before 1.39.15, 1.43.5, 1.44.2.
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Language/mediawiki.Language.Js. This issue affects MediaWiki: from * before 1.39.15, 1.43.5, 1.44.2.
Improper Neutralization of Input During Web Page Generation (XSS or 'C ...
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files resources/src/mediawiki.Language/mediawiki.Language.Js. This issue affects MediaWiki: from * before 1.39.15, 1.43.5, 1.44.2.
EPSS
4.6 Medium
CVSS3