PT-2024-2679 · Mediawiki+2 · Watchanalytics Extension+3

Ashley · Published 2024-01-12 · Updated 2025-06-19 · CVE-2024-23177

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.40.2 WatchAnalytics extension in MediaWiki (affected versions not specified)

Description An issue in the WatchAnalytics extension allows for XSS to occur via the Special:PageStatistics page parameter. This can enable a remote attacker to perform cross-site scripting attacks.

Recommendations For MediaWiki versions prior to 1.40.2, update to version 1.40.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the Special:PageStatistics page until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2025-5905

BDU:2024-02788

BIT-MEDIAWIKI-2024-23177

CVE-2024-23177

Affected Products

Alt Linux

Mediawiki

Red Os

Watchanalytics Extension

References · 9

• 🔥 https://phabricator.wikimedia.org/T348979 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-23177 · Security Note
• https://bdu.fstec.ru/vul/2024-02788 · Security Note
• https://osv.dev/vulnerability/BIT-mediawiki-2024-23177 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-23177 · Vendor Advisory
• https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce%40lists.wikimedia.org/message/TDBUBCCOQJUT4SCHJNPHKQNPBUUETY52 · Patch
• https://redos.red-soft.ru/support/secure · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-mediawiki-090424 · Note
• https://twitter.com/VulmonFeeds/status/1745771980693848422 · Twitter Post