Mjbommar

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - CentralAuth Extension allows Excavation. This issue affects Mediawiki - CentralAuth Extension: from * before 1.46.1, 1.45.5, 1.43.10.

**Name of the Vulnerable Software and Affected Versions** Mediawiki - Wikibase Extension versions prior to 1.46.1 Mediawiki - Wikibase Extension version 1.45.5 Mediawiki - Wikibase Extension version 1.43.10 **Description** Improper neutralization of input during web page generation allows for Stored Cross-site Scripting (XSS), a condition where malicious scripts are permanently stored on the target server. The issue occurs on the 'Special:SetSiteLink' endpoint due to an unescaped system message. **Recommendations** Update Mediawiki - Wikibase Extension to version 1.46.1 or later. Update Mediawiki - Wikibase Extension to a version newer than 1.45.5. Update Mediawiki - Wikibase Extension to a version newer than 1.43.10.

**Name of the Vulnerable Software and Affected Versions** Mediawiki - UserPageViewTracker Extension versions prior to 1.46.1 Mediawiki - UserPageViewTracker Extension version 1.45.5 Mediawiki - UserPageViewTracker Extension version 1.43.10 **Description** An unauthenticated SQL Injection occurs due to improper neutralization of special elements used in an SQL command. This allows an attacker to execute arbitrary SQL commands via the `filterusers` and `ignoreusers` parameters. **Recommendations** Update Mediawiki - UserPageViewTracker Extension to version 1.46.1 or later. Update Mediawiki - UserPageViewTracker Extension to a version newer than 1.45.5. Update Mediawiki - UserPageViewTracker Extension to a version newer than 1.43.10. As a temporary mitigation, restrict access to or avoid using the `filterusers` and `ignoreusers` parameters.