Change Details

Another issue reported by DAU Huy Ngoc. This was already fixed by https://gerrit.wikimedia.org/r/#/c/224826/ (T101608), but we should call out in the release that there was a security impact of that fix. ----- Hello, I found another XSS in the geshi plugin included in mediawiki 1.25.1. The POC is as follows: /extensions/SyntaxHighlight_GeSHi/geshi/contrib/cssgen.php?step=3&keywords-1=%3Cscript%3Ealert%281%29%3C/script%3E Note that WMF sites are not affected. I believe 1.26 and 1.24 branches don't use the same version of geshi. However, if you are gonna release 1.25.2 (as you mentioned earlier). There's a big chance that it will include the vulnerable plugin. Regards