PT-2023-25856 · Mediawiki+1 · Googleanalyticsmetrics+1

Bawolff · Publicado 2023-06-29 · Atualizado 2024-08-20 · CVE-2023-37251

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GoogleAnalyticsMetrics extension for MediaWiki versions through 1.39.3

Description An issue was discovered in the googleanalyticstrackurl parser function, which does not properly escape JavaScript in the onclick handler and does not prevent use of javascript: URLs.

Recommendations For versions through 1.39.3, update to a version that fixes the issue with the googleanalyticstrackurl parser function to prevent JavaScript injection through the onclick handler. As a temporary workaround, consider disabling the googleanalyticstrackurl parser function until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALT-PU-2023-4877

ALT-PU-2024-11168

ALT-PU-2024-1228

BIT-MEDIAWIKI-2023-37251

CVE-2023-37251

Produtos afetados

Alt Linux

Googleanalyticsmetrics

Referências · 107

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45360 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37251 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22911 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22910 · Nota de Segurança
• https://phabricator.wikimedia.org/T333050 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45373 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29197 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-02749 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-37251 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-02628 · Nota de Segurança
• https://t.me/cvenotify/53333 · Publicação no Telegram
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37301 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29140 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2024-1228 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39193 · Nota de Segurança