Description
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Wikimedia Foundation | Mediawiki - Cargo | 3.6.x – < 3.6.1 | 3.6.1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | mediawiki/cargo | < 3.6.1 | 3.6.1 | GHSA-jqvm-9xm2-gc38 |
Advisories 1
- WID-SEC-2024-3087 MediaWiki: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 19, 2025
References
- https://phabricator.wikimedia.org/T372211
- https://phabricator.wikimedia.org/T368628
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063804
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063806
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063827
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063831