Mediawiki Extensions Embedvideo
Monthly
Stored cross-site scripting in the StarCitizenWiki MediaWiki EmbedVideo extension (all versions prior to 4.1.0) allows a wiki editor to inject arbitrary HTML and JavaScript into pages by supplying a malformed video URL or ID whose embedded double quote escapes the src attribute of the generated iframe. Exploitation requires the non-default configuration $wgEmbedVideoRequireConsent to be disabled, so stock installations are unaffected, and it further requires the ability to insert an #ev parser function or embed tag into wiki content (page-edit rights) plus a victim rendering the poisoned page for the payload to fire. No public exploit code was identified at time of analysis and there is no CISA KEV entry; note that the CVSS 3.1 vector published in the CVE record (7.5, PR:N/UI:N/S:U) does not match the actual prerequisites, and the authoritative assessed vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.
Stored cross-site scripting in the StarCitizenWiki MediaWiki EmbedVideo extension (all versions prior to 4.1.0) allows a wiki editor to inject arbitrary HTML and JavaScript into pages by supplying a malformed video URL or ID whose embedded double quote escapes the src attribute of the generated iframe. Exploitation requires the non-default configuration $wgEmbedVideoRequireConsent to be disabled, so stock installations are unaffected, and it further requires the ability to insert an #ev parser function or embed tag into wiki content (page-edit rights) plus a victim rendering the poisoned page for the payload to fire. No public exploit code was identified at time of analysis and there is no CISA KEV entry; note that the CVSS 3.1 vector published in the CVE record (7.5, PR:N/UI:N/S:U) does not match the actual prerequisites, and the authoritative assessed vector is AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N.