未評価
An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur th...
CVE-2024-34500
SecPulse初出
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- web gerrit.wikimedia.org
- web lists.fedoraproject.org
- web phabricator.wikimedia.org