CVE-2023-3550

2023-09-2516:15:14

Debian Security Bug Tracker

security-tracker.debian.org

cve-2023-3550

mediawiki

xml

file upload

vulnerability

remote attacker

administrator

CVSS3

7.3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

AI Score

Confidence

High

EPSS

0.003

Percentile

69.4%

JSON

Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a low-privileged user account can use this exploit to become an administrator by sending a malicious link to the instance administrator.

OSVersionArchitecturePackageVersionFilename
Debian12allmediawiki< 1:1.39.5-1~deb12u1mediawiki_1:1.39.5-1~deb12u1_all.deb
Debian11allmediawiki< 1:1.35.13-1~deb11u1mediawiki_1:1.35.13-1~deb11u1_all.deb
Debian999allmediawiki< 1:1.39.5-1mediawiki_1:1.39.5-1_all.deb
Debian13allmediawiki< 1:1.39.5-1mediawiki_1:1.39.5-1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	12	all	mediawiki	< 1:1.39.5-1~deb12u1	mediawiki_1:1.39.5-1~deb12u1_all.deb
Debian	11	all	mediawiki	< 1:1.35.13-1~deb11u1	mediawiki_1:1.35.13-1~deb11u1_all.deb
Debian	999	all	mediawiki	< 1:1.39.5-1	mediawiki_1:1.39.5-1_all.deb
Debian	13	all	mediawiki	< 1:1.39.5-1	mediawiki_1:1.39.5-1_all.deb