Page MenuHomePhabricator
Create Task
Maniphest T327962

Reasonator XSS vulnerability
Closed, ResolvedPublicSecurity
Actions

Description

URL parameters like https://reasonator.toolforge.org/?find=%27%3C/input%3E%3Cscript%3Ealert(%27XSS%27)%3C/script%3E can be used to execute arbitrary JS.

Reporting on Phabricator per similar previous reports like T305764.

Details

Risk Rating
Medium
Author Affiliation
Wikimedia Communities

Related Objects

Event Timeline

1234qwer1234qwer4 created this task.Jan 25 2023, 9:44 PM
Restricted Application added a subscriber: Aklapper. · View Herald TranscriptJan 25 2023, 9:44 PM
1234qwer1234qwer4 assigned this task to Magnus.Jan 25 2023, 9:45 PM
sbassett edited projects, added Vuln-XSS, SecTeam-Processed, Tools; removed Security-Team.Jan 25 2023, 9:47 PM
sbassett added subscribers: Ladsgroup, Magnus.
Aklapper added a comment.Jan 25 2023, 9:58 PM

This may have to be reported at https://bitbucket.org/magnusmanske/reasonator/issues/ instead, I'm afraid...

Aklapper added a comment.Jul 4 2023, 9:48 AM

@Magnus: Hi, where to report such issues?

Magnus closed this task as Resolved.Nov 26 2025, 8:14 AM

Fixed.

sbassett triaged this task as Medium priority.Nov 27 2025, 4:18 PM
sbassett changed Author Affiliation from N/A to Wikimedia Communities.
sbassett changed the visibility from "Custom Policy" to "Public (No Login Required)".
sbassett changed the edit policy from "Custom Policy" to "All Users".
sbassett changed Risk Rating from N/A to Medium.
Content licensed under Creative Commons Attribution-ShareAlike (CC BY-SA) 4.0 unless otherwise noted; code licensed under GNU General Public License (GPL) 2.0 or later and other open source licenses. By using this site, you agree to the Terms of Use, Privacy Policy, and Code of Conduct. · Wikimedia Foundation · Privacy Policy · Code of Conduct · Terms of Use · Disclaimer · CC-BY-SA · GPL · Credits