PT-2023-25856 · Mediawiki+1 · Googleanalyticsmetrics+1

Bawolff · Published 2023-06-29 · Updated 2024-08-20 · CVE-2023-37251

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions GoogleAnalyticsMetrics extension for MediaWiki versions through 1.39.3

Description An issue was discovered in the googleanalyticstrackurl parser function, which does not properly escape JavaScript in the onclick handler and does not prevent use of javascript: URLs.

Recommendations For versions through 1.39.3, update to a version that fixes the issue with the googleanalyticstrackurl parser function to prevent JavaScript injection through the onclick handler. As a temporary workaround, consider disabling the googleanalyticstrackurl parser function until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2023-4877

ALT-PU-2024-11168

ALT-PU-2024-1228

BIT-MEDIAWIKI-2023-37251

CVE-2023-37251

Affected Products

Alt Linux

Googleanalyticsmetrics

References · 107

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45360 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22911 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22910 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45373 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29197 · Security Note
• https://bdu.fstec.ru/vul/2024-02749 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-37251 · Security Note
• https://bdu.fstec.ru/vul/2024-02628 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37301 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29140 · Security Note
• https://errata.altlinux.org/ALT-PU-2024-1228 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-39193 · Security Note
• https://osv.dev/vulnerability/CVE-2023-37251 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45372 · Security Note
• https://bdu.fstec.ru/vul/2024-02755 · Security Note