CVE-2023-36675
CVE-2023-36675
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.
CVSS 6.1 · Medium · EPSS 0.8% · Fix available
- Published
- Updated
Stack: system
Affected products and versions
n/a
- Versions
- n/a: Affected
No fix published
mediawiki Debian:12
- Versions
- 1:1.39.2-1
- Affected ranges
- ECOSYSTEM: < 1:1.39.4-1~deb12u1
Update to 1:1.39.4-1~deb12u1
mediawiki Debian:13
- Affected ranges
- ECOSYSTEM: < 1:1.39.4-1
Update to 1:1.39.4-1
mediawiki Debian:14
- Affected ranges
- ECOSYSTEM: < 1:1.39.4-1
Update to 1:1.39.4-1
mediawiki Ubuntu:18.04:LTS
- Versions
- 1:1.27.3-1
- 1:1.27.4-1
- 1:1.27.4-2
- 1:1.27.4-3
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mediawiki Ubuntu:Pro:20.04:LTS
- Versions
- 1:1.31.2-1ubuntu1
- 1:1.31.5-1
- 1:1.31.5-1ubuntu1
- 1:1.31.5-2
- 1:1.31.5-3
- 1:1.31.5-3ubuntu1
- 1:1.31.6-1
- 1:1.31.7-1
- 1:1.31.7-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mediawiki Ubuntu:Pro:22.04:LTS
- Versions
- 1:1.35.3-1
- 1:1.35.4-1
- 1:1.35.5-1
- 1:1.35.5-1ubuntu1
- 1:1.35.5-1ubuntu2
- 1:1.35.5-1ubuntu3
- 1:1.35.6-1
- 1:1.35.6-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mediawiki Ubuntu:Pro:24.04:LTS
- Versions
- 1:1.39.4-2
- 1:1.39.5-1
- 1:1.39.6-1
- 1:1.39.7-1
- 1:1.39.7-1ubuntu0.1~esm1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mediawiki Ubuntu:25.10
- Versions
- 1:1.43.1+dfsg-1
- 1:1.43.1+dfsg-2
- 1:1.43.3+dfsg-1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mediawiki Ubuntu:26.10
- Versions
- 1:1.43.8+dfsg-2
- 1:1.43.9+dfsg-1
- 1:1.43.9+dfsg-1ubuntu1
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
mediawiki Ubuntu:26.04:LTS
- Versions
- 1:1.43.3+dfsg-1
- 1:1.43.5+dfsg-1
- 1:1.43.6+dfsg-2
- 1:1.43.8+dfsg-1
- 1:1.43.8+dfsg-2
- Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
Original sources
- https://phabricator.wikimedia.org/T332889
- https://www.mediawiki.org/wiki/Release_notes/1.40#Other_changes_in_1.40
- https://www.debian.org/security/2023/dsa-5447
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DOAXEGYBOEM4JWB4J3BDH73NK2LCYC3O/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/2UIVGYECQGTUC2LLPVCZBPDLCTOHL2F6/
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/6CHRX6DSLAMVXCV2YMJEWOLTBEYSESE5/
- https://nvd.nist.gov/vuln/detail/CVE-2023-36675