Moderate severityNVD Advisory· Published Jun 30, 2023· Updated Nov 26, 2024

CVE-2023-37302

Description

An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a title attribute).

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
wikibase/wikibasePackagist	<= 1.39.3	—

Affected products

MediaWiki/Wikibasedescription
osv-coords2 versions
pkg:bitnami/mediawiki pkg:composer/wikibase/wikibase
< 1.39.4+ 1 more
- (no CPE)range: < 1.39.4
- (no CPE)range: <= 1.39.3

Patches

Vulnerability mechanics

References

github.com/advisories/GHSA-fmrf-p77g-vv5cghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2023-37302ghsaADVISORY
gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933649ghsaWEB
gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933650ghsaWEB
phabricator.wikimedia.org/T339111ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.260
epss	0.000
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000