CVE-2023-37251: 
NixOS vulnerability analysis and mitigation

An issue was discovered in the GoogleAnalyticsMetrics extension for MediaWiki through 1.39.3. The googleanalyticstrackurl parser function does not properly escape JavaScript in the onclick handler and does not prevent use of javascript: URLs (NVD, Wikimedia).

The vulnerability is classified as a Cross-Site Scripting (XSS) issue with a CVSS v3.1 Base Score of 6.1 MEDIUM (Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N). The issue stems from improper escaping in the googleAnalyticsTrackUrl parser function, which fails to properly handle JavaScript in onclick handlers and does not prevent the use of javascript: URLs. Additionally, the function does not register external links in the parser, which is important for antispam protection (NVD).

The vulnerability allows potential cross-site scripting attacks, enabling attackers to execute arbitrary JavaScript code in the context of the user's browser session. This could lead to unauthorized access to user data and potential manipulation of the web interface (NVD).

The vulnerability has been patched in the MediaWiki GoogleAnalyticsMetrics extension. Users should update to the latest version of the extension that includes the security fix. The fix includes proper escaping implementation in the googleAnalyticsTrackUrl function (Wikimedia).