CVE-2023-3550: Stored XSS leads to privilege escalation in MediaWiki v1.40.0
Mediawiki v1.40.0 does not validate namespaces used in XML files.
Therefore, if the instance administrator allows XML file uploads,
a remote attacker with a low-privileged user account can use this
exploit to become an administrator by sending a malicious link to
the instance administrator.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2023-3550.
What is the severity of CVE-2023-3550?
CVE-2023-3550 has a severity level of critical (9).
How does CVE-2023-3550 impact Mediawiki v1.40.0?
CVE-2023-3550 allows a remote attacker with a low-privileged user account to become an administrator by sending a malicious link to the instance administrator.
How can I fix CVE-2023-3550 in Mediawiki v1.40.0?
To fix CVE-2023-3550 in Mediawiki v1.40.0, you should apply the latest security patch provided by Mediawiki.
Where can I find more information about CVE-2023-3550?
You can find more information about CVE-2023-3550 in the following references: - Fluid Attacks Advisory: [https://fluidattacks.com/advisories/blondie/](https://fluidattacks.com/advisories/blondie/) - Mediawiki Documentation: [https://www.mediawiki.org/wiki/MediaWiki/](https://www.mediawiki.org/wiki/MediaWiki/)