CVE catalog

CVE-2023-3550

mediawiki: CVE-2023-3550

[CVE catalog]

Severity
Medium
Published
Source
[NVD] · [CVE record]
EPSS
1.38% · Oct 25, 2026

Mediawiki v1.40.0 does not validate namespaces used in XML files. Therefore, if the instance administrator allows XML file uploads, a remote attacker with a low-privileged user account can use this exploit to become an administrator by sending a malicious link to the instance administrator.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

DistributionPackageReleaseVersionStatus
Debianmediawikisid1:1.43.11+dfsg-3fixed
Debianmediawikiforky1:1.43.11+dfsg-1fixed
Debianmediawikitrixie1:1.43.9+dfsg-1~deb13u1fixed
Debianmediawikitrixie-security1:1.43.9+dfsg-1~deb13u1fixed
Debianmediawikibookworm1:1.39.17-1+deb12u2fixed
Debianmediawikibookworm-security1:1.39.17-1+deb12u2fixed

Fixed-version evidence

DistributionPackageTypeReleaseFixed versionUrgencyOriginBugs
Debianmediawikisourcesid1:1.39.5-1not yet assignedNot reportedNot reported
Debianmediawikisourceforky1:1.39.5-1not yet assignedNot reportedNot reported
Debianmediawikisourcetrixie1:1.39.5-1not yet assignedNot reportedNot reported
Debianmediawikisourcebookworm1:1.39.5-1~deb12u1not yet assignedNot reportedNot reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database]