VYPR
← All advisories
Moderate severityNVD Advisory· Published Jan 12, 2024· Updated Jun 3, 2025

CVE-2024-23173

CVE-2024-23173

Description

An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist, album, and position parameters because of applied filter values in drilldown/CargoAppliedFilter.php.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

A stored XSS vulnerability in MediaWiki's Cargo extension allows attackers to inject arbitrary JavaScript via unsanitized filter values on Special:Drilldown.

Vulnerability

Overview

The Cargo extension for MediaWiki is vulnerable to a reflected cross-site scripting (XSS) attack on the Special:Drilldown page. The flaw, identified as CVE-2024-23173, resides in the CargoAppliedFilter.php file, where filter values derived from query parameters such as artist, album, and position are output without proper HTML escaping [1]. This allows an attacker to inject arbitrary JavaScript code into the page. The issue affects MediaWiki versions before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2 [1].

Exploitation

Prerequisites

Exploitation requires no special privileges; an attacker can craft a malicious link containing the injected script as a parameter value. When a victim visits this link while logged into the wiki, the injected JavaScript executes in the context of the victim's session [2]. The attack surface is the public-facing Special:Drilldown interface.

Impact

Successful exploitation enables the attacker to perform actions on behalf of the victim, including stealing session cookies, exfiltrating page content, or performing administrative actions if the victim has elevated rights [3]. The attack is classified with a medium risk rating [3].

Mitigation

Status

The fix was implemented in a commit that introduces htmlspecialchars() escaping to the applied filter values [4]. Administrators must upgrade their Cargo extension to the patched versions: MediaWiki 1.35.14, 1.39.6, 1.40.2, or later. No workaround is available if the patch cannot be applied.

References
  1. NVD - CVE-2024-23173
  2. GitHub - wikimedia/mediawiki-extensions-Cargo: Github mirror of MediaWiki extension Cargo - our actual code is hosted with Gerrit (please see https://www.mediawiki.org/wiki/Developer_access for contributing
  3. T348687 CVE-2024-23173: Reflected XSS Could Lead to Steal User Cookie
  4. Add escaping of applied filter values · wikimedia/mediawiki-extensions-Cargo@e4f0b7f

AI Insight generated on May 20, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
mediawiki/cargoPackagist
< 1.35.141.35.14
mediawiki/cargoPackagist
>= 1.36.0, < 1.39.61.39.6
mediawiki/cargoPackagist
>= 1.40.0, < 1.40.21.40.2

Affected products

3

Patches

1
e4f0b7fb11da

Add escaping of applied filter values

https://github.com/wikimedia/mediawiki-extensions-CargoYaron KorenOct 11, 2023via ghsa
commit
1 file changed · +3 −0
  • drilldown/CargoAppliedFilter.php+3 −0 modified
    @@ -41,6 +41,9 @@ public static function create( $filter, $values, $search_terms = null, $lower_da
 		if ( !is_array( $values ) ) {
 			$values = [ $values ];
 		}
+		foreach ( $values as &$value ) {
+			$value = htmlspecialchars( $value );
+		}
 		foreach ( $values as $val ) {
 			$filter_val = CargoFilterValue::create( $val, $filter );
 			$af->values[] = $filter_val;

Vulnerability mechanics

Generated on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

5

News mentions

0

No linked articles in our index yet.