CVE-2024-23171: XSS
An issue was discovered in the CampaignEvents extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:EventDetails page allows XSS via the x-xss language setting for internationalization (i18n).
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23171?
CVE-2024-23171 has a severity rating that indicates it can lead to Cross-Site Scripting (XSS) attacks.
How do I fix CVE-2024-23171?
To fix CVE-2024-23171, upgrade MediaWiki to version 1.35.14, 1.39.6, or 1.40.2 or later.
What versions of MediaWiki are affected by CVE-2024-23171?
CVE-2024-23171 affects MediaWiki versions before 1.35.14, and the range from 1.36.x to 1.39.x before 1.39.6, as well as 1.40.x before 1.40.2.
What is the nature of the vulnerability in CVE-2024-23171?
The vulnerability in CVE-2024-23171 is an XSS issue that can be exploited through the x-xss language setting on the Special:EventDetails page.
Is a workaround available for CVE-2024-23171 if I can't upgrade?
There are no specific workarounds mentioned for CVE-2024-23171, so upgrading is the recommended solution.