PT-2023-8973 · Mediawiki+1 · Mediawiki+1

Dreamy_Jazz · Published 2023-12-21 · Updated 2025-06-19 · CVE-2023-51704

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.35.14 MediaWiki versions 1.36.x through 1.39.x before 1.39.6 MediaWiki versions 1.40.x before 1.40.2

Description The issue is related to improper input neutralization during web page creation, which can lead to cross-site scripting (XSS) attacks. This can be exploited by a remote attacker, allowing them to perform XSS attacks on Special:log/rights. The vulnerability is specifically related to group-*-member messages in the includes/logging/RightsLogFormatter.php file.

Recommendations For MediaWiki versions prior to 1.35.14, update to version 1.35.14 or later. For MediaWiki versions 1.36.x through 1.39.x before 1.39.6, update to version 1.39.6 or later. For MediaWiki versions 1.40.x before 1.40.2, update to version 1.40.2 or later. As a temporary workaround, consider restricting access to the Special:log/rights page until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2025-5905

BDU:2024-02778

BIT-MEDIAWIKI-2023-51704

CVE-2023-51704

DLA-3796-1

DLA-3896-1

MGASA-2024-0155

Affected Products

Mediawiki

Red Os

References · 78

• 🔥 https://phabricator.wikimedia.org/T347726 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34500 · Security Note
• https://security-tracker.debian.org/tracker/source-package/mediawiki · Vendor Advisory
• https://ubuntu.com/security/CVE-2023-51704 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mediawiki-2023-51704 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34506 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40603 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-51704 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23179 · Security Note
• https://bdu.fstec.ru/vul/2024-03520 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-47913 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-40599 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-51704 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-23178 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-34502 · Security Note