CVE-2023-36675

An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.

Score

CVSS 3.1 6.1 Medium

Status

Modified - cve@mitre.org

Published

2023-06-26

Last modified

2024-12-05

Weaknesses

CWE-79

Affected products

• Mediawiki (Mediawiki)

References

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UIVGYECQGTUC2LLPVCZBP…
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CHRX6DSLAMVXCV2YMJEWO…
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOAXEGYBOEM4JWB4J3BDH7…
• https://phabricator.wikimedia.org/T332889
• https://www.debian.org/security/2023/dsa-5447
• https://www.mediawiki.org/wiki/Release_notes/1.40#Other_changes_in_1.40