CVE-2024-23173

Summary

CVE-2024-23173 is a vulnerability affecting the Cargo extension in MediaWiki versions before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. This issue permits Cross-Site Scripting (XSS) attacks through the Special:Drilldown page. Attackers can exploit this vulnerability by manipulating artist, album, and position parameters in the drilldown/CargoAppliedFilter.php file, which in turn, applies filters with malicious scripts. Successful exploitation could lead to unauthorized access, data theft, or website defacement. Users are strongly advised to update their MediaWiki installations to mitigate this risk.

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.