CVE-2023-36675
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x...
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- Required
What an attacker can affect
- Confidentiality
- Low
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.
- Record
CVE-2023-36675- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.
- Record
CVE-2023-36675- Updated
- 2026-11-02
EUVDEUVD-2023-40618 No score
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.
- Record
EUVD-2023-40618- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-q7gg-775p-p35h
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x...
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, 1.39.x before 1.39.4, and 1.40.x before 1.40.1. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.
- Record
GHSA-q7gg-775p-p35h- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-36675
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.
- Record
DEBIAN-CVE-2023-36675- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-36675
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.
- Record
UBUNTU-CVE-2023-36675- CVSS 3.1
- 6.1 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N - Updated
- 2026-11-02
OSVBIT-mediawiki-2023-36675 No score
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.
- Record
BIT-mediawiki-2023-36675- Updated
- 2026-11-02
OSV No score
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.
- Record
CVE-2023-36675- Updated
- 2026-11-02
OSVMGASA-2023-0241 No score
Updated mediawiki packages fix security vulnerability
guzzlehttp/psr7 is a PSR-7 HTTP message library implementation in PHP. Affected versions are subject to improper header parsing. An attacker could sneak in a newline (\n) into both the header names and values. While the specification states that \r\n\r\n is used to terminate the header list, many servers in the wild will also accept \n\n (CVE-2023-29197).
Manualthumb bypasses badFile lookup (CVE-2023-36674).
XSS in BlockLogFormatter due to unsafe message use (CVE-2023-36675).
- Record
MGASA-2023-0241- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiBitnami |
before 1.35.11, 1.36.0 up to 1.38.7, 1.39.0 up to 1.39.4 | 1.35.111.38.71.39.4 |
mediawikiDebian:12 |
before 1:1.39.4-1~deb12u1, plus listed versions 1:1.39.2-1 |
1:1.39.4-1~deb12u1 |
mediawikiDebian:13 |
before 1:1.39.4-1 | 1:1.39.4-1 |
mediawikiDebian:14 |
before 1:1.39.4-1 | 1:1.39.4-1 |
mediawikiDebian:11 From an advisory covering 3 CVEs |
before 1:1.35.11-1~deb11u1, plus listed versions 1:1.35.2-11:1.35.3-11:1.35.4-11:1.35.4-1+deb11u21:1.35.4-1~deb11u1 Show 7 moreShow less1:1.35.5-11:1.35.5-21:1.35.6-11:1.35.7-11:1.35.8-11:1.35.8-1.11:1.35.8-1~deb11u1 |
1:1.35.11-1~deb11u1 |
mediawikiDebian:12 From an advisory covering 3 CVEs |
before 1:1.39.4-1~deb12u1, plus listed versions 1:1.39.2-1 |
1:1.39.4-1~deb12u1 |
mediawikiMageia:8 From an advisory covering 3 CVEs |
before 1.35.11-1.mga8 | 1.35.11-1.mga8 |
mediawikiUbuntu:18.04:LTS |
All versions, plus listed versions 1:1.27.3-11:1.27.4-11:1.27.4-21:1.27.4-3 |
None known |
mediawikiUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:1.31.2-1ubuntu11:1.31.5-11:1.31.5-1ubuntu11:1.31.5-21:1.31.5-3 Show 4 moreShow less1:1.31.5-3ubuntu11:1.31.6-11:1.31.7-11:1.31.7-1ubuntu0.1~esm1 |
None known |
mediawikiUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1:1.35.3-11:1.35.4-11:1.35.5-11:1.35.5-1ubuntu11:1.35.5-1ubuntu21:1.35.5-1ubuntu31:1.35.6-11:1.35.6-1ubuntu0.1~esm1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mediawikiUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1:1.39.4-21:1.39.5-11:1.39.6-11:1.39.7-11:1.39.7-1ubuntu0.1~esm1 |
None known |
mediawikiUbuntu:25.10 |
All versions, plus listed versions 1:1.43.1+dfsg-11:1.43.1+dfsg-21:1.43.3+dfsg-1 |
None known |
mediawikiUbuntu:26.10 |
All versions, plus listed versions 1:1.43.8+dfsg-21:1.43.9+dfsg-11:1.43.9+dfsg-1ubuntu1 |
None known |
mediawikiUbuntu:26.04:LTS |
All versions, plus listed versions 1:1.43.3+dfsg-11:1.43.5+dfsg-11:1.43.6+dfsg-21:1.43.8+dfsg-11:1.43.8+dfsg-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-36675 is a medium vulnerability (CVSS 6.1) in Mediawiki, published June 26, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.83%, the 57th percentile. Fixed in mediawiki 1.35.11.
References
phabricator.wikimedia.org/T332889
mediawiki.org/wiki/Release_notes/1.40
debian.org/security/2023/dsa-5447
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOAXEGYBOEM4JWB4J3BDH73NK2LCYC3O
Show 13 moreShow less
nvd.nist.gov/vuln/detail/CVE-2023-36675
github.com/advisories/GHSA-q7gg-775p-p35h
security-tracker.debian.org/tracker/CVE-2023-36675
advisories.mageia.org/MGASA-2023-0241.html
bugs.mageia.org/show_bug.cgi?id=32083
lists.wikimedia.org/hyperkitty/list/[email protected]/thread/HVT3U3XYY35PSCIQPHMY4VQNF3Q6MHUO
ubuntu.com/security/CVE-2023-36675
gerrit.wikimedia.org/r/c/mediawiki/core/+/921452
cve.org/CVERecord?id=CVE-2023-36675