CVE-2024-23173: XSS
An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist, album, and position parameters because of applied filter values in drilldown/CargoAppliedFilter.php.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-23173?
CVE-2024-23173 is considered a moderate severity vulnerability due to its potential for Cross-Site Scripting (XSS).
How do I fix CVE-2024-23173?
To fix CVE-2024-23173, upgrade your MediaWiki installation to version 1.35.14 or later, or to any version above 1.39.6 or 1.40.2.
What systems are affected by CVE-2024-23173?
CVE-2024-23173 affects MediaWiki versions before 1.35.14, versions 1.36.x through 1.39.x before 1.39.6, and versions 1.40.x before 1.40.2.
What type of vulnerability is CVE-2024-23173?
CVE-2024-23173 is a Cross-Site Scripting (XSS) vulnerability that can be exploited via specific parameters on the Special:Drilldown page.
What parameters are involved in CVE-2024-23173?
The parameters involved in CVE-2024-23173 are artist, album, and position, which can lead to XSS if improperly filtered.