CyberRota Analysis
AI-GeneratedThe EmbedVideo Extension for MediaWiki prior to version 4.1.0 is vulnerable due to improper handling of user-supplied class values, allowing attackers to inject arbitrary HTML and JavaScript into rendered pages. This could lead to cross-site scripting (XSS) attacks, compromising the security of users who view the affected content. Organizations using this extension should prioritize updating to version 4.1.0 to mitigate potential exploitation risks.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, EmbedHtmlFormatter::toHtml in includes/EmbedService/EmbedHtmlFormatter.php passes the user-supplied class value directly to sprintf while constructing a figure element. A quote in the class value can terminate the class attribute and inject arbitrary HTML attributes or markup into the rendered page. A user able to edit a wiki page can store JavaScript that executes for visitors who render the affected content. This issue is fixed in version 4.1.0.