CVE-2024-25107: Cross-Site Scripting in WikiDiscover
WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. On Special:WikiDiscover, the Language::date function is used when making the human-readable timestamp for inclusion on the wikicreation column. This function uses interface messages to translate the names of months and days. It uses the ->text() output mode, returning unescaped interface messages. Since the output is not escaped later, the unescaped interface message is included on the output, resulting in an XSS vulnerability. Exploiting this on-wiki requires the (editinterface) right. This vulnerability has been addressed in commit 267e763a0. Users are advised to update their installations. There are no known workarounds for this vulnerability.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
WikiDiscoverto a version that resolves this vulnerability.Patch 267e763a0
Event History
Frequently Asked Questions
What is the severity of CVE-2024-25107?
CVE-2024-25107 has a medium severity rating due to its potential impact on the display of timestamps in the WikiDiscover extension.
How do I fix CVE-2024-25107?
To fix CVE-2024-25107, update the WikiDiscover extension to the latest version released after February 8, 2023.
Which software versions are affected by CVE-2024-25107?
CVE-2024-25107 affects the WikiDiscover extension for Miraheze versions prior to 2023-02-08.
Is CVE-2024-25107 actively being exploited?
As of now, there are no confirmed reports of CVE-2024-25107 being actively exploited in the wild.
What functions are involved in CVE-2024-25107?
CVE-2024-25107 involves the Language::date function used for generating human-readable timestamps in the WikiDiscover extension.