CVE-2023-45359: 
Linux Debian vulnerability analysis and mitigation

An issue was discovered in the Vector Skin component for MediaWiki before 1.39.5 and 1.40.x before 1.40.1. The vulnerability involves the vector-toc-toggle-button-label parameter which is not properly escaped, allowing markup injection because the line parameter can contain markup (NVD).

The vulnerability is related to improper encoding or escaping of output in the Vector Skin component. The issue specifically affects the vector-toc-toggle-button-label parameter, which fails to properly escape markup content. This has been classified as CWE-116 (Improper Encoding or Escaping of Output). The vulnerability has received a CVSS v3.1 Base Score of 6.5 (MEDIUM) with the vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N (NVD).

The vulnerability could potentially allow attackers to inject markup through the line parameter, which could lead to unauthorized content manipulation or potential cross-site scripting attacks in the table of contents component (NVD).

The vulnerability has been fixed in MediaWiki versions 1.39.5 and 1.40.1. The fix involves properly escaping the vector-toc-toggle-button-label parameter by making it a raw parameter. Users are advised to upgrade to these or later versions (Wikimedia Gerrit).