CVE-2024-23174

MEDIUM

MediaWiki PageTriage Extension < 1.35.14, 1.36-1.39 < 1.39.6, 1.40 < 1.40.2 - Stored XSS via Messages

Title source: llm
STIX 2.1

Description

An issue was discovered in the PageTriage extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. XSS can occur via the rev-deleted-user, pagetriage-tags-quickfilter-label, pagetriage-triage, pagetriage-filter-date-range-format-placeholder, pagetriage-filter-date-range-to, pagetriage-filter-date-range-from, pagetriage-filter-date-range-heading, pagetriage-filter-set-button, or pagetriage-filter-reset-button message.

References (2)

Core 2

Scores

CVSS v3 5.4
EPSS 0.0040
EPSS Percentile 60.9%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-79
Status published
Products (1)
mediawiki/mediawiki < 1.35.14
Published Jan 12, 2024
Tracked Since Feb 18, 2026