Description

An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3. The googleanalyticstrackurl parser function does not properly escape JavaScript in the onclick handler and does not prevent use of javascript: URLs.

Remediation

References

CVE-2023-37251

Related Vulnerabilities

WordPress Plugin Booking.com Product Helper Unspecified Vulnerability (1.0.3)

phpList Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2017-20032)

WordPress Plugin WPML (WordPress Multilingual) Cross-Site Scripting (3.2.6)

WordPress Plugin Smart Slider 3 Cross-Site Scripting (3.5.0.8)

WordPress Plugin Husker Portfolio Cross-Site Request Forgery (0.3)

Severity

Medium

Classification

CVE-2023-37251 CWE-707 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N

Tags

Missing Update Known Vulnerabilities