Maniphest T310027

get_distinct_authors XSS vulnerability
Closed, ResolvedPublicSecurity
Actions

Assigned To

Authored By

	1234qwer1234qwer4
	Jun 6 2022, 10:09 PM

Tags

Referenced Files

None

Subscribers

1234qwer1234qwer4

Description

URL parameters like https://magnustools.toolforge.org/get_distinct_authors.php?project=%27%3C/input%3E%3Cscript%3Ealert(%27XSS%27)%3C/script%3E can be used to execute arbitrary JS.

Reporting on Phabricator per similar previous reports like T305764.

Details

Risk Rating: Medium
Author Affiliation: Wikimedia Communities

Related Objects

Mentioned Here: T305764: PetScan XSS vulnerability

Event Timeline

1234qwer1234qwer4 created this task.Jun 6 2022, 10:09 PM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJun 6 2022, 10:09 PM

1234qwer1234qwer4 assigned this task to Magnus.Jun 6 2022, 10:09 PM

Aklapper added projects: Vuln-XSS, Tools.Jun 7 2022, 6:51 AM

sbassett edited projects, added SecTeam-Processed; removed Security-Team.Jun 13 2022, 4:17 PM

Fixed.

sbassett triaged this task as Medium priority.Nov 27 2025, 4:19 PM

sbassett changed Author Affiliation from N/A to Wikimedia Communities.

sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".

sbassett changed the edit policy from "Custom Policy" to "All Users".

sbassett changed Risk Rating from N/A to Medium.