CVE-2023-37302: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

June 30, 2023 (updated July 7, 2023)

An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a title attribute).

References

gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933649
gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933650
github.com/advisories/GHSA-fmrf-p77g-vv5c
nvd.nist.gov/vuln/detail/CVE-2023-37302
phabricator.wikimedia.org/T339111

Detect and mitigate CVE-2023-37302 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →