CVE-2023-37255
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk32th percentile - higher than 32% of all known CVEs
Summary
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In Special:CheckUser, a check of the 'get edits' type is vulnerable to HTML injection through the User-Agent HTTP request header.
Risk Assessment
An attacker could exploit this vulnerability to inject malicious HTML code, potentially leading to data theft or manipulation of the user interface.
Recommendation
It is recommended to update the CheckUser extension to the latest version to mitigate this vulnerability and to monitor server logs for potential attack attempts.
Original NVD description (English source)
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. In Special:CheckUser, a check of the "get edits" type is vulnerable to HTML injection through the User-Agent HTTP request header.