CVE-2024-36123mediumCWE-79

CVE-2024-36123: falha de média gravidade em StarCitizenTools mediawiki-skins-Citizen

Citizen has a Stored Cross-Site Scripting Vulnerability by editing MediaWiki:Tagline

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar mediawiki-skins-Citizen

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.5%
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The page `MediaWiki:Tagline` has its contents used unescaped, so custom HTML (including Javascript) can be injected by someone with the ability to edit the MediaWiki namespace (typically those with the `editinterface` permission, or sysops). This vulnerability is fixed in 2.16.0.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
StarCitizenTools · mediawiki-skins-Citizen
CVEs relacionadas — StarCitizenTools mediawiki-skins-Citizen

No mesmo produto, das mais perigosas para as menos.

CVE-2024-47536MEDIUMstarcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" fieldEPSS 0.5%CVE-2025-62508MEDIUMCitizen vulnerable to stored XSS in sticky header button messagesEPSS 0.4%CVE-2025-49578MEDIUMCitizen allows stored XSS in user registration date messageEPSS 0.4%CVE-2025-49576MEDIUMCitizen allows stored XSS in search no result messagesEPSS 0.4%CVE-2025-49575MEDIUMCitizen allows stored XSS in Command Palette tip messagesEPSS 0.4%CVE-2025-49577MEDIUMCitizen allows stored XSS in preference menu headingsEPSS 0.4%