PT-2023-8946 · Mediawiki+2 · Mediawiki Proofreadpage Extension+2

Soda · Published 2023-10-08 · Updated 2024-08-20 · CVE-2023-45373

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki ProofreadPage extension versions prior to 1.35.12 MediaWiki ProofreadPage extension versions 1.36.x through 1.39.x before 1.39.5 MediaWiki ProofreadPage extension versions 1.40.x before 1.40.1

Description The issue exists due to a lack of protection for the web page structure in the ProofreadPage extension for MediaWiki. This can allow a remote attacker to perform cross-site scripting attacks. The attack can occur via the formatNumNoSeparators function.

Recommendations For MediaWiki ProofreadPage extension versions prior to 1.35.12, update to version 1.35.12 or later. For MediaWiki ProofreadPage extension versions 1.36.x through 1.39.x, update to version 1.39.5 or later. For MediaWiki ProofreadPage extension versions 1.40.x before 1.40.1, update to version 1.40.1 or later. As a temporary workaround, consider disabling the formatNumNoSeparators function until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2023-6419

ALT-PU-2024-11168

ALT-PU-2024-1228

BDU:2024-02748

BIT-MEDIAWIKI-2023-45373

CVE-2023-45373

Affected Products

Alt Linux

Mediawiki Proofreadpage Extension

Red Os

References · 109

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45360 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22911 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22910 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45373 · Security Note
• https://bdu.fstec.ru/vul/2024-02749 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29197 · Security Note
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/ProofreadPage/+/961262 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-02628 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-37301 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-29140 · Security Note
• https://errata.altlinux.org/ALT-PU-2024-1228 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-45372 · Security Note
• https://bdu.fstec.ru/vul/2024-02755 · Security Note
• https://phabricator.wikimedia.org/T345693 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-22945 · Security Note