Mediawiki Mediasearch Extension
Monthly
Cross-site scripting (XSS) in the MediaWiki MediaSearch extension (versions 1.46, 1.45, and 1.43) allows an authenticated user to inject script-related HTML into the media search interface, which executes in the browser of a victim who passively interacts with the crafted content. The vulnerability requires the MediaSearch extension to be installed and enabled, and impact is limited to low confidentiality and integrity with no server-side code execution. No public exploit code has been identified at the time of analysis, and the CVSS 4.0 score is 1.2; an upstream fix is available via Gerrit change I79e8200289bd120c3c971ba830776eaae779bb99.
Cross-site scripting (XSS) in the MediaWiki MediaSearch extension (versions 1.46, 1.45, and 1.43) allows an authenticated user to inject script-related HTML into the media search interface, which executes in the browser of a victim who passively interacts with the crafted content. The vulnerability requires the MediaSearch extension to be installed and enabled, and impact is limited to low confidentiality and integrity with no server-side code execution. No public exploit code has been identified at the time of analysis, and the CVSS 4.0 score is 1.2; an upstream fix is available via Gerrit change I79e8200289bd120c3c971ba830776eaae779bb99.