Vulnerability · Published Sep 25, 2023 · Assigned by Fluid Attacks
CVE-2023-3550Stored XSS leads to privilege escalation in MediaWiki v1.40.0
High 7.3
In plain English
A high-severity cross-site scripting in MediaWiki from MediaWiki. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 1.4% (higher than 72% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)1.4%top 27.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack toolingNoneno public tooling known
Official description
Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a low-privileged user account can use this exploit to become an administrator by sending a malicious link to the instance administrator.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | mediawiki | 1:1.39.5-1~deb12u1 | DSA-5520-1 |
| Debian:12 | mediawiki | 1:1.39.5-1~deb12u1 | DEBIAN-CVE-2023-3550 |
| Debian:13 | mediawiki | 1:1.39.5-1 | DEBIAN-CVE-2023-3550 |
| Debian:14 | mediawiki | 1:1.39.5-1 | DEBIAN-CVE-2023-3550 |
| Ubuntu:25.10 | mediawiki | no fix listed | UBUNTU-CVE-2023-3550 |
| Ubuntu:26.04:LTS | mediawiki | no fix listed | UBUNTU-CVE-2023-3550 |
| Ubuntu:26.10 | mediawiki | no fix listed | UBUNTU-CVE-2023-3550 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N
References
- https://fluidattacks.com/advisories/blondie/
- https://www.mediawiki.org/wiki/MediaWiki/
- https://www.debian.org/security/2023/dsa-5520
- https://lists.debian.org/debian-lts-announce/2023/11/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/