Unrated
An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur th...
CVE-2024-34500
First seen on SecPulse
Original description The description as published by the source.
An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory lists.fedoraproject.org
- advisory nvd.nist.gov
- web gerrit.wikimedia.org
- web lists.fedoraproject.org
- web phabricator.wikimedia.org