CVE-2024-23173 Information

Description

An issue was discovered in the Cargo extension in MediaWiki before 1.35.14 1.36.x through 1.39.x before 1.39.6 and 1.40.x before 1.40.2. The Special:Drilldown page allows XSS via artist album and position parameters because of applied filter values in drilldown/CargoAppliedFilter.php.

Reference

https://phabricator.wikimedia.org/T348687 https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/965214