CVE-2023-22911

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.35.9 MediaWiki versions 1.36.x through 1.38.x before 1.38.5 MediaWiki versions 1.39.x before 1.39.1

Description An issue in MediaWiki allows for XSS due to E-Widgets performing widget replacement in HTML attributes. This can lead to security issues because widget authors often do not expect their widgets to be executed in an HTML attribute context.

Recommendations For MediaWiki versions prior to 1.35.9, update to version 1.35.9 or later. For MediaWiki versions 1.36.x through 1.38.x before 1.38.5, update to version 1.38.5 or later. For MediaWiki versions 1.39.x before 1.39.1, update to version 1.39.1 or later.