Mediawiki Centralnotice Extension
Monthly
Stored cross-site scripting in the Wikimedia CentralNotice extension lets anyone who can create or edit a banner/campaign persist a JavaScript payload that executes in the browser of every user who views the rendered notice, allowing session-rideable actions and content tampering within the victim's MediaWiki origin. MediaWiki installations running an affected non-default CentralNotice build (before 1.46.1, 1.45.5, or 1.43.10) are exposed; per the CISA SSVC evaluation exploitation has not been observed, automatable exploitation is assessed as no, and no public exploit code was identified at time of analysis, though the vendor's CVSS vector (6.1, PR:N) understates the privilege realistically required to store the payload. Our independent assessment keeps the vendor's CVSS:3.1:AV:N/AC:L/S:C/C:L/I:L/UI:R base but changes the privilege requirement to PR:L, since injecting via a CentralNotice banner field normally demands the centralnotice-admin user right, and impact remains partial confidentiality/integrity with no availability effect.
Stored cross-site scripting in the Wikimedia CentralNotice extension lets anyone who can create or edit a banner/campaign persist a JavaScript payload that executes in the browser of every user who views the rendered notice, allowing session-rideable actions and content tampering within the victim's MediaWiki origin. MediaWiki installations running an affected non-default CentralNotice build (before 1.46.1, 1.45.5, or 1.43.10) are exposed; per the CISA SSVC evaluation exploitation has not been observed, automatable exploitation is assessed as no, and no public exploit code was identified at time of analysis, though the vendor's CVSS vector (6.1, PR:N) understates the privilege realistically required to store the payload. Our independent assessment keeps the vendor's CVSS:3.1:AV:N/AC:L/S:C/C:L/I:L/UI:R base but changes the privilege requirement to PR:L, since injecting via a CentralNotice banner field normally demands the centralnotice-admin user right, and impact remains partial confidentiality/integrity with no availability effect.