VULNERABILITY INTELLIGENCE

CVE-2023-22911

CVSS score6.1 MEDIUM

EPSS probability0.57%

CISA KEVNot currently listed

Published2023-01-10

Last modified2026-06-17

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Description

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. E-Widgets does widget replacement in HTML attributes, which can lead to XSS, because widget authors often do not expect that their widget is executed in an HTML attribute context.

Weakness classification

nvd@nist.gov: CWE-79
134c704f-9b21-4f2e-91b3-4a467353bcc0: CWE-79

Primary references

cve@mitre.org
cve@mitre.org — Exploit, Issue Tracking, Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108
af854a3a-2127-422b-91ae-364da2661108 — Exploit, Issue Tracking, Patch, Vendor Advisory