CVE-2024-34500 json
MediaWiki UnlinkedWikibase Cross-site Scripting vulnerability
published 2024-05-05 2 y ago modified 2026-06-17 4 mo ago also BIT-mediawiki-2024-34500 , EUVD-2024-1874 , GHSA-wcx3-63mm-h8x6
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 41%
- public exploits
- 0
- none known
Summary
An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.
Patch / fix
- packagist samwilson/unlinked-wikibase 1.42.0
- bitnami mediawiki 1.41.1
- mediawiki mediawiki 1.39.6, 1.40.2, 1.41.1
Vendor advisories
What the vendors themselves say about their products: affected, fixed or not affected, and what to do.
red hat product security vex CVE-2024-34500 updated cvss 5.3
mediawiki: XSS through interface message in UnlinkedWikibase
-
Red Hat OpenShift Container Platform 3.11 mediawikiaffected: no fix planned “Out of support scope”
Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.47% chance of exploitation in the next 30 days, higher than 41% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| GitHub | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| OSV | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | samwilson/unlinked-wikibase | <1.42.0 |
1.42.0 |
| bitnami | mediawiki | <1.41.1 |
1.41.1 |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
gerrit.wikimedia.org
/r/c/mediawiki/extensions/UnlinkedWikibase/+/1002175
web, patch, vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/
vendor-advisory, third-party-advisory, web
-
phabricator.wikimedia.org
/T357203
web, issue-tracking, vendor-advisory
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/
web
-
nvd.nist.gov
/vuln/detail/CVE-2024-34500
advisory, web
-
github.com
/github/advisory-database/pull/5310
web
-
gerrit.wikimedia.org
/r/mediawiki/extensions/UnlinkedWikibase.git
package
-
lists.fedoraproject.org
/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY
web
-
lists.fedoraproject.org
/archives/list/package-announce@lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY
web
Sources
- CVE List CVE-2024-34500
- GitHub Advisory GHSA-wcx3-63mm-h8x6
- NVD CVE-2024-34500
- OSV BIT-mediawiki-2024-34500
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.