Skip to content
OpenAdvisories
High WID-SEC-2023-1695 11 CVEs

MediaWiki: Mehrere Schwachstellen

Published Jul 9, 2023 · Updated Sep 13, 2026 · Revision 2 · de-DE

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen, einen Cross-Site-Scripting-Angriff durchzuführen und Angriffe mit unspezifischen Auswirkungen auszuführen.

Product

MediaWiki ist ein freies Wiki, das ursprünglich für den Einsatz auf Wikipedia entwickelt wurde.

Vulnerabilities 11

  • Medium 6.1
    CVE-2023-37302

    MediaWiki Cross-site Scripting vulnerability

    An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a…

    mediawiki wikibase/wikibase Ubuntu Packagist
  • Low 3.1
    CVE-2023-37252

    An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. Special:CheckUserLog shows usernames t…

    mediawiki CheckUser
  • Low 3.1
    CVE-2023-37253

    An issue was discovered in the ProofreadPage extension for MediaWiki through 1.39.3. It leaks information about a suppr…

    mediawiki ProofreadPage
  • Unscored —
    CVE-2023-37251

    An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3. The googleanalyticstracku…

  • Unscored —
    CVE-2023-37254

    An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. XSS can occur in Special:CargoQuery via a …

  • Unscored —
    CVE-2023-37255

    An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In Special:CheckUser, a check of the "…

  • Unscored —
    CVE-2023-37256

    An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. It allows one to store javascript: URLs in…

  • Unscored —
    CVE-2023-37301

    An issue was discovered in SubmitEntityAction in Wikibase in MediaWiki through 1.39.3. Because it doesn't use EditEntit…

    mediawiki Ubuntu
  • Unscored —
    CVE-2023-37303

    An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In certain situations, an attempt to b…

    mediawiki Ubuntu
  • Unscored —
    CVE-2023-37304

    An issue was discovered in the DoubleWiki extension for MediaWiki through 1.39.3. includes/DoubleWiki.php allows XSS vi…

    mediawiki Ubuntu
  • Unscored —
    CVE-2023-37305

    An issue was discovered in the ProofreadPage (aka Proofread Page) extension for MediaWiki through 1.39.3. In includes/P…

    mediawiki Ubuntu

Revision history

  1. #2

    Referenz(en) aufgenommen: EUVD-2023-60663, EUVD-2023-60664

  2. #1

    Initiale Fassung

References