PT-2023-8946 · Mediawiki+2 · Mediawiki Proofreadpage Extension+2

Soda · Publicado 2023-10-08 · Atualizado 2024-08-20 · CVE-2023-45373

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki ProofreadPage extension versions prior to 1.35.12 MediaWiki ProofreadPage extension versions 1.36.x through 1.39.x before 1.39.5 MediaWiki ProofreadPage extension versions 1.40.x before 1.40.1

Description The issue exists due to a lack of protection for the web page structure in the ProofreadPage extension for MediaWiki. This can allow a remote attacker to perform cross-site scripting attacks. The attack can occur via the formatNumNoSeparators function.

Recommendations For MediaWiki ProofreadPage extension versions prior to 1.35.12, update to version 1.35.12 or later. For MediaWiki ProofreadPage extension versions 1.36.x through 1.39.x, update to version 1.39.5 or later. For MediaWiki ProofreadPage extension versions 1.40.x before 1.40.1, update to version 1.40.1 or later. As a temporary workaround, consider disabling the formatNumNoSeparators function until a patch is available.

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

ALT-PU-2023-6419

ALT-PU-2024-11168

ALT-PU-2024-1228

BDU:2024-02748

BIT-MEDIAWIKI-2023-45373

CVE-2023-45373

Produtos afetados

Alt Linux

Mediawiki Proofreadpage Extension

Red Os

Referências · 109

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45360 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22911 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22910 · Nota de Segurança
• https://phabricator.wikimedia.org/T333050 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45373 · Nota de Segurança
• https://bdu.fstec.ru/vul/2024-02749 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29197 · Nota de Segurança
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ProofreadPage/+/961262 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2024-02628 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37301 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29140 · Nota de Segurança
• https://errata.altlinux.org/ALT-PU-2024-1228 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45373 · Nota
• https://phabricator.wikimedia.org/T307278 · Nota
• https://phabricator.wikimedia.org/T306741 · Nota