Bug 2272577 (T355538) - mediawiki: XSS in edit summary parser
Summary: mediawiki: XSS in edit summary parser
Keywords:
Status: NEW
Alias: T355538
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2278773
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-04-02 02:39 UTC by Robb Gatica
Modified: 2024-05-03 02:10 UTC (History)
0 users

Fixed In Version: mediawiki 1.39.7, mediawiki 1.40.3, mediawiki 1.41.1
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description Robb Gatica 2024-04-02 02:39:00 UTC 
Mediawiki security releases 1.39.7, 1.40.3 and 1.41.1, includes fix for cross site scripting vulnerability in edit summary parser. CVE assignment is still pending. 

References:
https://phabricator.wikimedia.org/T355538
https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/V3WXEPXV2DU6WTVEKK4XHW4QXD5OFKD7/
Comment 1 Robb Gatica 2024-05-03 02:10:31 UTC 
Created mediawiki tracking bugs for this issue:

Affects: fedora-all [bug 2278773]
Note You need to log in before you can comment on or make changes to this bug.