CVE-2023-3550 — Stored XSS leads to privilege escalation in MediaWiki v1.40.0
Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a low-privileged use…
Published: 2023-09-25 · CVSS: 7.3 · CVSS 3.1
Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a low-privileged user account can use this exploit to become an administrator by sending a malicious link to the instance administrator.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7