Description

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. E-Widgets does widget replacement in HTML attributes, which can lead to XSS, because widget authors often do not expect that their widget is executed in an HTML attribute context.

Remediation

References

CVE-2023-22911

Related Vulnerabilities

Oracle Application Server CVE-2008-7236 Vulnerability (CVE-2008-7236)

WebLogic CVE-2017-10123 Vulnerability (CVE-2017-10123)

WordPress Plugin Ajax Store Locator SQL Injection (1.2.0)

Joomla! Core 3.x.x Multiple Cross-Site Scripting Vulnerabilities (3.0.0 - 3.9.3)

MySQL CVE-2019-2743 Vulnerability (CVE-2019-2743)

Severity

Medium

Classification

CVE-2023-22911 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Tags

Missing Update Known Vulnerabilities