Wikimedia Foundation MediaWiki Cargo Extension Cross-Site Scripting Vulnerability

A cross-site scripting (XSS) vulnerability has been identified in the Wikimedia Foundation MediaWiki Cargo Extension, affecting versions prior to 3.8.7. This vulnerability arises from improper input validation during web page generation, allowing for the injection of unsanitized inline styles into non-script elements. The issue is present in multiple display formats within the Cargo extension.

Impact

Exploitation of this vulnerability allows for cross-site scripting, where an attacker can inject malicious scripts that are executed in the context of the user's browser.

Reproduction

To reproduce this vulnerability, create a template named 'Calendar' and declare a Cargo table. Then, store a date in the table and visit the template page, purging it if necessary. The injected styles will be applied to the calendar format, demonstrating the CSS injection vulnerability.

Remediation

Users can update to MediaWiki Cargo Extension version 3.8.7 or later to address this vulnerability.