PT-2023-29530 · Mediawiki+1 · Mediawiki+1

Published 2023-10-10 · Updated 2024-10-11 · CVE-2023-45359

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.39.5 MediaWiki versions 1.40.x prior to 1.40.1

Description An issue was discovered in the Vector Skin component for MediaWiki. The vector-toc-toggle-button-label is not escaped, but should be, because the line param can have markup. This issue affects multiple versions of MediaWiki with the Vector skin. Users are urged to update to the latest version to mitigate risks.

Recommendations For MediaWiki versions prior to 1.39.5, update to version 1.39.5 or later. For MediaWiki versions 1.40.x prior to 1.40.1, update to version 1.40.1 or later. As a temporary workaround, consider disabling the vector-toc-toggle-button-label until a patch is available.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

ALT-PU-2023-6419

ALT-PU-2024-11168

ALT-PU-2024-1228

CVE-2023-45359

DSA-5520-1

MGASA-2024-0155

Affected Products

Alt Linux

Mediawiki

References · 130

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45360 · Security Note
• https://security-tracker.debian.org/tracker/source-package/mediawiki · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22911 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22910 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45373 · Security Note
• https://bdu.fstec.ru/vul/2024-02749 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29197 · Security Note
• https://bdu.fstec.ru/vul/2024-02628 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37301 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29140 · Security Note
• https://errata.altlinux.org/ALT-PU-2024-1228 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45372 · Security Note
• https://bdu.fstec.ru/vul/2024-02755 · Security Note
• https://osv.dev/vulnerability/DSA-5520-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22945 · Security Note