{"id":"GHSA-rhpm-63w5-79rg","summary":"MediaWiki Cargo Extension Cross-site Scripting vulnerability","details":"An issue was discovered in the Cargo extension in MediaWiki before 1.35.14, 1.36.x through 1.39.x before 1.39.6, and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist, album, and position parameters because of applied filter values in drilldown/CargoAppliedFilter.php.","aliases":["BIT-mediawiki-2024-23173","CVE-2024-23173"],"modified":"2025-09-29T15:57:17.177294Z","published":"2024-01-12T06:30:16Z","database_specific":{"github_reviewed":true,"github_reviewed_at":"2025-09-29T15:21:30Z","nvd_published_at":"2024-01-12T05:15:10Z","cwe_ids":["CWE-79"],"severity":"MODERATE"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23173"},{"type":"WEB","url":"https://github.com/wikimedia/mediawiki-extensions-Cargo/commit/e4f0b7fb11da0e4b18f2c416101965e417ba3bd2"},{"type":"WEB","url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/965214"},{"type":"PACKAGE","url":"https://github.com/wikimedia/mediawiki-extensions-Cargo"},{"type":"WEB","url":"https://phabricator.wikimedia.org/T348687"}],"affected":[{"package":{"name":"mediawiki/cargo","ecosystem":"Packagist","purl":"pkg:composer/mediawiki/cargo"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.14"}]}],"versions":["0.10","0.11","1.0","1.0.1","1.1.1","1.2","1.3","1.3.1","1.4","1.5","1.6","1.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-rhpm-63w5-79rg/GHSA-rhpm-63w5-79rg.json"}},{"package":{"name":"mediawiki/cargo","ecosystem":"Packagist","purl":"pkg:composer/mediawiki/cargo"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.36.0"},{"fixed":"1.39.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-rhpm-63w5-79rg/GHSA-rhpm-63w5-79rg.json"}},{"package":{"name":"mediawiki/cargo","ecosystem":"Packagist","purl":"pkg:composer/mediawiki/cargo"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.40.0"},{"fixed":"1.40.2"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/01/GHSA-rhpm-63w5-79rg/GHSA-rhpm-63w5-79rg.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"}]}