CVE-2023-36675

An issue was discovered in MediaWiki before 1.35.11, 1.36.x through 1.38.x before 1.38.7, and 1.39.x before 1.39.4. BlockLogFormatter.php in BlockLogFormatter allows XSS in the partial blocks feature.

References

Affected packages

Git / github.com/wikimedia/mediawiki

Affected ranges

Type

GIT

Repo

https://github.com/wikimedia/mediawiki

Events

Introduced

Fixed

b8d14e9d292f1199b959b9ce26d99f72bf935406

Introduced

bc542ec6d8573dfb906b468901799e0017875f1e

Fixed

059c8e1b9a315c36ae827f929ea9a077acbba2eb

Introduced

c95fc4786beba034fa643062b98a60ccbde831fd

Fixed

c4075dfdbcb51df3c922aef582cf5b4091759595

Database specific

{
    "source": "CPE_FIELD",
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.35.11"
        },
        {
            "introduced": "1.36.0"
        },
        {
            "fixed": "1.38.7"
        },
        {
            "introduced": "1.39.0"
        },
        {
            "fixed": "1.39.4"
        }
    ],
    "cpe": "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*"
}

Affected versions

1.*

1.1.0

1.3.0beta1

1.35.0

1.35.0-rc.0

1.35.0-rc.1

1.35.0-rc.2

1.35.0-rc.3

1.35.1

1.35.10

1.35.2

1.35.3

1.35.4

1.35.5

1.35.6

1.35.7

1.35.8

1.35.9

1.38.0

1.38.0-rc.0

1.38.0-rc.1

1.38.1

1.38.2

1.38.3

1.38.4

1.38.5

1.38.6

1.39.0

1.39.1

1.39.2

1.39.3

1.5.0alpha1

1.5.0alpha2

1.5.0beta1

1.5.0beta2

1.5.0beta3

1.5.0beta4

1.6.0

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2023-36675.json"