CNNVD-202506-1702 Information
CNNVD ID
CNNVD-202506-1702
Related CVE
- CNNVD Published: 2025-06-12
Description (Chinese)
Citizen是Star Citizen Wiki团队的一款美观、易用、响应迅速的MediaWiki皮肤。 Citizen 3.3.1之前版本存在跨站脚本漏洞，该漏洞源于Language::userDate返回的日期消息插入原始HTML，可能导致任意HTML注入。
Description (English)
Citizen is a beautiful, easy-to-use and responsive MediaWiki skin of Star Citizen Wiki’s team. The previous version of Citizen 3.3.1 had a cross-site script loophole, which originated from the date message returned by Language: userDate inserting the original HTML, which could lead to any type of HTML injection.
Hazard Level
High
Vulnerability Type
跨站脚本
Affected Vendor
Star Citizen Wiki
Published
2025-06-12
Last Modified
2026-02-24
References
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-2v3v-3whp-953h https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/64cb5d7ab3a6dc0381fae54b31e8fc4afadc8beb https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/93c36ac778397e0e7c46cf7adb1e5d848265f1bd https://access.redhat.com/security/cve/cve-2025-49578 https://nvd.nist.gov/vuln/detail/CVE-2025-49578
Patch
https://github.com/StarCitizenTools/mediawiki-skins-Citizen/releases
Share on: