CVE-2023-37302

Name of the Vulnerable Software and Affected Versions MediaWiki versions through 1.39.3

Description An issue was discovered in SiteLinksView.php in Wikibase. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a title attribute).

Recommendations For versions through 1.39.3, update to a version that includes the fix for the XSS issue in SiteLinksView.php and the lack of escaping in wbTemplate. As a temporary workaround, consider disabling the use of crafted badge title attributes until a patch is available. Restrict access to the wbTemplate function to minimize the risk of exploitation. Avoid using quotes in title attributes in the affected API endpoints until the issue is resolved.