CVE-2023-3550
Stored XSS leads to privilege escalation in MediaWiki v1.40.0
Summary
Stored XSS leads to privilege escalation in MediaWiki v1.40.0
Original description
The description as published by the source.
Mediawiki v1.40.0 does not validate namespaces used in XML files.
Therefore, if the instance administrator allows XML file uploads,
a remote attacker with a low-privileged user account can use this
exploit to become an administrator by sending a malicious link to
the instance administrator.
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-3550 mediawiki Fixed in: 1:1.35.13-1~deb11u1
- Ubuntu UBUNTU-CVE-2023-3550 mediawiki
References
- advisory fluidattacks.com
- advisory github.com
- advisory nvd.nist.gov
- advisory debian.org
- web lists.debian.org
- web lists.fedoraproject.org
- web mediawiki.org