CVE-2023-37302

Severity: medium (CVSS 6.1 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2023-06-30 · updated 2026-06-17
Weakness: CWE-79

Description

An issue was discovered in SiteLinksView.php in Wikibase in MediaWiki through 1.39.3. There is XSS via a crafted badge title attribute. This is also related to lack of escaping in wbTemplate (from resources/wikibase/templates.js) for quotes (which can be in a title attribute).

Affected products

Wikimedia Foundation MediaWiki: through 1.39.3

References

https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933649
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933650
https://phabricator.wikimedia.org/T339111
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933649
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wikibase/+/933650
https://phabricator.wikimedia.org/T339111

Get alerted when CVE-2023-37302 or the next vulnerability affects your stack