CVE-2023-3550 Stored XSS leads to privilege escalation in MediaWiki v1.40.0
A stored XSS vulnerability in MediaWiki allows low-privileged users to escalate privileges to administrator if XML uploads are enabled.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2023-3550?
CVE-2023-3550 is a high-severity cross-site scripting vulnerability in Debian Debian Linux, published on 25 Sep 2023. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
Mediawiki v1.40.0 does not validate namespaces used in XML files.
Therefore, if the instance administrator allows XML file uploads,
a remote attacker with a low-privileged user account can use this
exploit to become an administrator by sending a malicious link to
the instance administrator.
Weakness: CWE-79
Which versions are affected by CVE-2023-3550?
2 open source packages ship an affected version, including mediawiki and mediawiki/core. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
mediawiki Bitnami | From 1.40.0 | 1.40.1 |
mediawiki/core Packagist | All versions to 1.40.0 | None |
Products include Debian Debian Linux, Mediawiki Mediawiki.
How do I fix CVE-2023-3550?
Upgrade mediawiki to 1.40.1 or later.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2023-3550 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-3550 exists.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as BIT-mediawiki-2023-3550, DEBIAN-CVE-2023-3550, GHSA-4pqg-hr8r-h5cw, UBUNTU-CVE-2023-3550.