CVE-2023-37302

An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a title attribute).

CVSS v3.1 NVD

6.1 MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS

0.69% chance of exploitation in the next 30 days, 52nd percentile

Published

2023-06-30

Updated

2024-11-26

Proof-of-concept exploits (1)

• https://phabricator.wikimedia.org/T339111

Security advisories

• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933649
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933650
• advisories/GHSA-fmrf-p77g-vv5c

References

• CVE Record
• NVD entry