Description

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. E-Widgets does widget replacement in HTML attributes, which can lead to XSS, because widget authors often do not expect that their widget is executed in an HTML attribute context.

Remediation

References

CVE-2023-22911

Related Vulnerabilities

Ruby on Rails Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2016-0752)

WordPress Plugin Thrive Apprentice Security Bypass (2.3.9.3)

WordPress Plugin Share on Diaspora Cross-Site Scripting (0.7.1)

WordPress Plugin Google Maps Cross-Site Scripting (2.1.3)

XWiki Weak Password Recovery Mechanism for Forgotten Password Vulnerability (CVE-2022-23619)

Severity

Medium

Classification

CVE-2023-22911 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities