Description

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. E-Widgets does widget replacement in HTML attributes, which can lead to XSS, because widget authors often do not expect that their widget is executed in an HTML attribute context.

Remediation

References

CVE-2023-22911

Related Vulnerabilities

WordPress Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2015-5731)

Dolphin Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-27969)

WordPress Plugin YaySMTP-Simple WP SMTP Mail Cross-Site Scripting (2.4.5)

WordPress Plugin Zotpress 'citation' Parameter Cross-Site Scripting (2.6.1)

Magento Authorization Bypass Through User-Controlled Key Vulnerability (CVE-2019-7864)

Severity

Medium

Classification

CVE-2023-22911 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities