CVE-2023-37251: XSS
Published Jun 29, 2023
·Updated
An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3. The googleanalyticstrackurl parser function does not properly escape JavaScript in the onclick handler and does not prevent use of javascript: URLs.
Affected Software
1 affected component
MediaWiki MediaWiki<=1.39.3
Event History
Jun 29, 2023
CVE Published
via MITRE·12:00 AM
Data Sourced
via MITRE·12:00 AM
Description
Data Sourced
via NVD·04:15 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the vulnerability ID?
The vulnerability ID is CVE-2023-37251.
2
What is the affected software?
The affected software is MediaWiki versions up to and including 1.39.3.
3
What is the severity of CVE-2023-37251?
The severity of CVE-2023-37251 is medium.
4
What is the Common Vulnerabilities and Exposures (CVE) entry for this vulnerability?
The Common Vulnerabilities and Exposures (CVE) entry for this vulnerability is CVE-2023-37251.
5
How can I fix this vulnerability?
To fix this vulnerability, update MediaWiki to version 1.39.4 or later.