Vulnerability · Published May 5, 2024 · Assigned by mitre
CVE-2024-34500
Medium 6.1
In plain English
A medium-severity cross-site scripting in the samwilson/unlinked-wikibase package (Packagist). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Packagist | samwilson/unlinked-wikibase | 1.42.0 | GHSA-wcx3-63mm-h8x6 |
Affected products (as reported)
Weakness: CWE-79 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N