CVE-2025-49579mediumCWE-79

CVE-2025-49579: falha de média gravidade em StarCitizenTools mediawiki-skins-Citizen

Citizen allows stored XSS in menu heading message

Publicada em

Seguir esta CVE+ Monitorar mediawiki-skins-Citizen+ Monitorar starcitizentools/citizen-skin

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.4%
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. All system messages in menu headings using the Menu.mustache template are inserted as raw HTML, allowing anybody who can edit those messages to insert arbitrary HTML into the DOM. This impacts wikis where a group has the `editinterface` but not the `editsitejs` user right. This vulnerability is fixed in 3.3.1.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
StarCitizenTools · mediawiki-skins-Citizen
CVEs relacionadas — StarCitizenTools mediawiki-skins-Citizen

No mesmo produto, das mais perigosas para as menos.

CVE-2024-36123MEDIUMCitizen has a Stored Cross-Site Scripting Vulnerability by editing MediaWiki:TaglineEPSS 0.5%CVE-2024-47536MEDIUMstarcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" fieldEPSS 0.5%CVE-2025-62508MEDIUMCitizen vulnerable to stored XSS in sticky header button messagesEPSS 0.4%CVE-2025-49578MEDIUMCitizen allows stored XSS in user registration date messageEPSS 0.4%CVE-2025-49576MEDIUMCitizen allows stored XSS in search no result messagesEPSS 0.4%CVE-2025-49575MEDIUMCitizen allows stored XSS in Command Palette tip messagesEPSS 0.4%