{"id":"CVE-2024-34500","aliases":["BIT-mediawiki-2024-34500","EUVD-2024-1874","GHSA-wcx3-63mm-h8x6"],"status":"published","title":"MediaWiki UnlinkedWikibase Cross-site Scripting vulnerability","description":"An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-10","score":0.00473,"percentile":0.4126,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2024-05-05T00:00:00Z","modified":"2026-10-28T02:30:52Z","fixes":[{"ecosystem":"Packagist","package":"samwilson/unlinked-wikibase","fixed_in":["1.42.0"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"mediawiki","fixed_in":["1.41.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"samwilson/unlinked-wikibase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.42.0"}]}]},{"source":"osv","ecosystem":"Bitnami","package":"mediawiki","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.41.1"}]}]},{"source":"osv","ecosystem":"Packagist","package":"samwilson/unlinked-wikibase","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.42.0"}]}],"versions":["1.0.0"]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"https://phabricator.wikimedia.org/T357203","tags":["x_transferred","Issue Tracking","Vendor Advisory","web"]},{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/UnlinkedWikibase/+/1002175","tags":["x_transferred","Patch","Vendor Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/","tags":["vendor-advisory","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34500","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY","tags":["web"]},{"url":"https://github.com/github/advisory-database/pull/5310","tags":["web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY","tags":["web"]},{"url":"https://github.com/advisories/GHSA-wcx3-63mm-h8x6"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34500.json","tags":["advisory"]},{"url":"https://gerrit.wikimedia.org/r/mediawiki/extensions/UnlinkedWikibase.git","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2024-34500","description":"An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.","status":"published","published":"2024-05-05T00:00:00Z","modified":"2025-11-04T17:20:45.386Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"adp"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:34:23.516065Z"}],"euvd":[{"id":"EUVD-2024-1874","description":"An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.","status":"published","published":"2024-05-05T00:00:00Z","modified":"2025-11-04T17:20:45Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T19:49:25.004858Z"}],"ghsa":[{"id":"GHSA-wcx3-63mm-h8x6","title":"MediaWiki UnlinkedWikibase Cross-site Scripting vulnerability","description":"An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.42.0. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.","status":"published","published":"2024-05-05T21:30:30Z","modified":"2025-11-04T18:31:58Z","cvss":[{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"},{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:39:06.376137Z"}],"nvd":[{"id":"CVE-2024-34500","description":"An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.","status":"published","published":"2024-05-05T19:15:07.123Z","modified":"2026-06-17T07:33:31.78Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:09:56.122111Z"}],"osv":[{"id":"CVE-2024-34500","description":"An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.","status":"published","published":"2024-05-05T00:00:00Z","modified":"2026-10-28T02:30:52.577491225Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"GHSA-wcx3-63mm-h8x6","title":"MediaWiki UnlinkedWikibase Cross-site Scripting vulnerability","description":"An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.42.0. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.","status":"published","published":"2024-05-05T21:30:30Z","modified":"2025-11-04T18:49:56.869692Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"},{"version":"4.0","score":5.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"BIT-mediawiki-2024-34500","description":"An issue was discovered in the UnlinkedWikibase extension in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. XSS can occur through an interface message. Error messages (in the $err var) are not escaped before being passed to Html::rawElement() in the getError() function in the Hooks class.","status":"published","published":"2025-06-12T05:57:36.774Z","modified":"2025-11-06T13:25:46.476Z","updated_at":"2026-11-02T15:28:33.072289Z"}]}}