medium5.4
CVE-2023-22910
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1.
Impact
An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. There is XSS in Wikibase date formatting via wikibase-time-precision-* fields. This allows JavaScript execution by staff/admin users who do not intentionally have the editsitejs capability.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mediawiki | Mediawiki | before 1.35.9 from 1.36.0 before 1.38.5 Version 1.39.0 |