CVE-2024-34507

Published: 5 May 2024

An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. XSS can occur because of mishandling of the 0x1b character, as demonstrated by Special:RecentChanges#%1b0000000.

Status

References

• https://www.cve.org/CVERecord?id=CVE-2024-34507
• https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/V3WXEPXV2DU6WTVEKK4XHW4QXD5OFKD7/
• https://phabricator.wikimedia.org/T355538
• https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1015422
• NVD
• Launchpad
• Debian