CVE-2023-37251

Name of the Vulnerable Software and Affected Versions GoogleAnalyticsMetrics extension for MediaWiki versions through 1.39.3

Description An issue was discovered in the googleanalyticstrackurl parser function, which does not properly escape JavaScript in the onclick handler and does not prevent use of javascript: URLs.

Recommendations For versions through 1.39.3, update to a version that fixes the issue with the googleanalyticstrackurl parser function to prevent JavaScript injection through the onclick handler. As a temporary workaround, consider disabling the googleanalyticstrackurl parser function until a patch is available.