An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3. The googleanalyticstrackurl parser function does not properly escape JavaScript in the onclick handler and does not prevent use of javascript: URLs.
Metrics
Affected Vendors & Products
References
Link | Providers |
---|---|
https://phabricator.wikimedia.org/T333980 |
History
Tue, 26 Nov 2024 20:15:00 +0000
Type | Values Removed | Values Added |
---|---|---|
Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: mitre
Published: 2023-06-29T00:00:00
Updated: 2024-11-26T19:37:48.675Z
Reserved: 2023-06-29T00:00:00
Link: CVE-2023-37251
Vulnrichment
Updated: 2024-08-02T17:09:33.307Z
NVD
Status : Modified
Published: 2023-06-29T16:15:09.947
Modified: 2024-11-21T08:11:18.753
Link: CVE-2023-37251
Redhat
No data.