Mediawiki Readinglists Extension
Monthly
Reflected cross-site scripting in the MediaWiki ReadingLists extension (versions 1.45 and 1.46) lets an authenticated user with access to the extension inject script-related HTML into a page through a crafted URL parameter that is echoed back unsanitized. Because the flaw is reflected rather than stored, an attacker must lure a separate logged-in victim into following the malicious link, and any script executes only within that victim's browser session - there is no server-side compromise. This is a low-priority issue despite being network-reachable: no public exploit code has been identified at time of analysis, exploitation is blocked on wikis that do not have the extension or have applied the upstream fix, and the attack is further constrained by the requirement that the victim actively follow the crafted URL.
Reflected cross-site scripting in the MediaWiki ReadingLists extension (versions 1.45 and 1.46) lets an authenticated user with access to the extension inject script-related HTML into a page through a crafted URL parameter that is echoed back unsanitized. Because the flaw is reflected rather than stored, an attacker must lure a separate logged-in victim into following the malicious link, and any script executes only within that victim's browser session - there is no server-side compromise. This is a low-priority issue despite being network-reachable: no public exploit code has been identified at time of analysis, exploitation is blocked on wikis that do not have the extension or have applied the upstream fix, and the attack is further constrained by the requirement that the victim actively follow the crafted URL.