CVE Catalog
CVE-2023-37256
MediumCVSS 6.1Exploitation Probability (EPSS)
Low risk0.41%
32th percentile - higher than 32% of all known CVEs
Summary
An issue was discovered in the Cargo extension for MediaWiki through version 1.39.3, allowing the storage of javascript: URLs in URL fields and automatically linking these URLs.
Risk Assessment
The ability to inject malicious JavaScript poses a risk of XSS attacks, potentially leading to user data theft or session hijacking.
Recommendation
It is recommended to update to the latest version of MediaWiki and to monitor and filter URLs entered in fields.
Original NVD description (English source)
An issue was discovered in the Cargo extension for MediaWiki through 1.39.3. It allows one to store javascript: URLs in URL fields, and automatically links these URLs.