MediaWiki: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Summary

Product

Vulnerabilities 8

• Medium 6.1
  CVE-2024-23173

  MediaWiki Cargo Extension Cross-site Scripting vulnerability

  An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist, album, and position parameters because of applied filter values in dri…

  mediawiki/cargo Packagist
  Jan 12, 2024
• Medium 6.1
  CVE-2024-23177

  An issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2. XSS can occur via the Special:PageS…

  Jan 12, 2024
• Medium 6.1
  CVE-2024-23179

  An issue was discovered in the GlobalBlocking extension in MediaWiki before 1.40.2. For a Special:GlobalBlock?uselang=x…

  Jan 12, 2024
• Medium 5.4
  CVE-2024-23171

  An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.…

  Jan 12, 2024
• Medium 5.4
  CVE-2024-23172

  An issue was discovered in the CheckUser extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, an…

  Jan 12, 2024
• Medium 5.4
  CVE-2024-23174

  An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, a…

  Jan 12, 2024
• Medium 5.4
  CVE-2024-23176

  An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xs…

  mediawiki MassMessage
  Sep 14, 2026
• Medium 5.4
  CVE-2024-23178

  An issue was discovered in the Phonos extension in MediaWiki before 1.40.2. PhonosButton.js allows i18n-based XSS via t…

  Jan 12, 2024

Revision history

1. 2026-09-13 #3

   Referenz(en) aufgenommen: EUVD-2024-55763

2. 2024-01-17 #2

   CVE ergänzt

3. 2024-01-14 #1

   Initiale Fassung

References

• NIST Vulnerability Database vom 2024-01-14
  https://nvd.nist.gov/vuln/detail/CVE-2024-23171
• NIST Vulnerability Database vom 2024-01-14
  https://nvd.nist.gov/vuln/detail/CVE-2024-23172
• NIST Vulnerability Database vom 2024-01-14
  https://nvd.nist.gov/vuln/detail/CVE-2024-23173
• NIST Vulnerability Database vom 2024-01-14
  https://nvd.nist.gov/vuln/detail/CVE-2024-23174
• NIST Vulnerability Database vom 2024-01-14
  https://nvd.nist.gov/vuln/detail/CVE-2024-23177
• NIST Vulnerability Database vom 2024-01-14
  https://nvd.nist.gov/vuln/detail/CVE-2024-23178
• NIST Vulnerability Database vom 2024-01-14
  https://nvd.nist.gov/vuln/detail/CVE-2024-23179