Vector inserts portlet labels as HTML, allowing for stored XSS through system messages
3Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 0epss 0.4%
exploitation probability
0.4%top 69% of all CVEs
observed exploitation
nono source reports it
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Vector. This vulnerability is associated with program files resources/skins.Vector.Js/portlets.Js, resources/skins.Vector.Legacy.Js/portlets.Js.
This issue affects Vector: from >= 1.40.0 before 1.42.7, 1.43.2, 1.44.0.
CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:P/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N
Affected products
Wikimedia Foundation · Vector