CVE-2024-34500

Katalog CVE

CVSS 6.1 · Medium EPSS 0,47%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada mediawiki, fedoraproject fedora. Skor CVSS 3.1 6.1 (Medium) menurut CISA ADP.

Deskripsi (NVD)

An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.

Rincian

Terbit di NVD

5 Mei 2024

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber CISA ADP
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

0,47% peluang dieksploitasi; lebih tinggi dari 39,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/UnlinkedWikibase/+/1002175 patch · advisory vendor
• https://phabricator.wikimedia.org/T357203 issue tracking · advisory vendor
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV... advisory pihak ketiga
• https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FU2FGUXXK6TMV6R...