CVE-2024-25109CWE-79

Cross-Site Scripting in the extensions, settings, permissions and namespaces subpages of ManageWiki

Medium · published February 9, 2024

CVSS v3.1
6.5
EPSS
0%
Percentile
37.9
In the wild
Unconfirmed
What it is

ManageWiki is a MediaWiki extension allowing users to manage wikis. Special:ManageWiki does not escape escape interface messages on the `columns` and `help` keys on the form descriptor. An attacker may exploit this and would have a cross site scripting attack vector. Exploiting this on-wiki requires the `(editinterface)` right. Users should apply the code changes in commits `886cc6b94`, `2ef0f50880`, and `6942e8b2c` to resolve this vulnerability. There are no known workarounds for this vulnerability.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
CVSS v4.0
Not supplied
EPSS
0.00448 · 37.9th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2024-02-09T22:25Z
EPSS history
Timeline
  • 09 FEB 22:25Z
    Cross-Site Scripting in the extensions, settings, permissions and namespaces subpages of ManageWiki
    cvelistv5