Mediawiki Wikibase Extension
Monthly
Authenticated low-privilege users can exploit a deserialization flaw in the MediaWiki Wikibase extension (versions 1.43, 1.45, and 1.46) to potentially execute arbitrary code, but exploitation is gated by high attack complexity, a specific precondition, and victim interaction. The vulnerability (CWE-502) allows untrusted serialized data to be processed, leading to code execution in non-executable files. A proof-of-concept exploit may exist (CVSS 4.0 E:P), but there is no confirmed active exploitation (not in CISA KEV).
Stored cross-site scripting (XSS) in the MediaWiki Wikibase Extension allows remote attackers to inject malicious script that is stored on a wiki page and later executed in another user's browser when that page is viewed; the CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.1). Affected are Wikibase Extension versions before 1.46.1, 1.45.5, and 1.43.10; exploitation requires user interaction (UI:R) and results in low confidentiality and integrity impact with scope change, not full server compromise. No public exploit identified at time of analysis, and CISA SSVC rates exploitation as none and automatable as no; a vendor patch is available.
Cross-site scripting (XSS) in the Wikibase extension for MediaWiki allows unauthenticated remote attackers to inject malicious scripts into wiki pages, which execute when a victim views the affected content. The flaw affects Wikibase versions prior to 1.46.1, 1.45.5, and 1.43.10; exploitation requires user interaction and yields low confidentiality/integrity impact limited to the victim's browser session. No public exploit code or active exploitation has been identified at time of analysis.
Authenticated low-privilege users can exploit a deserialization flaw in the MediaWiki Wikibase extension (versions 1.43, 1.45, and 1.46) to potentially execute arbitrary code, but exploitation is gated by high attack complexity, a specific precondition, and victim interaction. The vulnerability (CWE-502) allows untrusted serialized data to be processed, leading to code execution in non-executable files. A proof-of-concept exploit may exist (CVSS 4.0 E:P), but there is no confirmed active exploitation (not in CISA KEV).
Stored cross-site scripting (XSS) in the MediaWiki Wikibase Extension allows remote attackers to inject malicious script that is stored on a wiki page and later executed in another user's browser when that page is viewed; the CVSS 3.1 vector is CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (6.1). Affected are Wikibase Extension versions before 1.46.1, 1.45.5, and 1.43.10; exploitation requires user interaction (UI:R) and results in low confidentiality and integrity impact with scope change, not full server compromise. No public exploit identified at time of analysis, and CISA SSVC rates exploitation as none and automatable as no; a vendor patch is available.
Cross-site scripting (XSS) in the Wikibase extension for MediaWiki allows unauthenticated remote attackers to inject malicious scripts into wiki pages, which execute when a victim views the affected content. The flaw affects Wikibase versions prior to 1.46.1, 1.45.5, and 1.43.10; exploitation requires user interaction and yields low confidentiality/integrity impact limited to the victim's browser session. No public exploit code or active exploitation has been identified at time of analysis.