CVE-2023-45373

MEDIUM

MediaWiki ProofreadPage Extension XSS via formatNumNoSeparators

Title source: llm
STIX 2.1

Description

An issue was discovered in the ProofreadPage extension for MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. XSS can occur via formatNumNoSeparators.

References (2)

Core 2
Core References
Issue Tracking, Vendor Advisory
https://phabricator.wikimedia.org/T345693

Scores

CVSS v3 6.1
EPSS 0.0031
EPSS Percentile 54.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (2)
mediawiki/mediawiki 1.40.0
mediawiki/mediawiki < 1.35.12
Published Oct 09, 2023
Tracked Since Feb 18, 2026