Reflected cross-site scripting (XSS) In mediawiki/cargo
Description
MediaWiki Cargo Extension Cross-site Scripting vulnerability An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist, album, and position parameters because of applied filter values in drilldown/CargoAppliedFilter.php.
Mitigation
Update Impact
Minimal update. May introduce new vulnerabilities or breaking changes.
Ecosystem | Package | Affected version | Patched versions |
|---|---|---|---|
 packagist | 1.35.14, 1.39.6, 1.40.2 |
Aliases
1. 2. 3. 4.
References
1. 2. 3.