CVE-2024-23177: 
NixOS vulnerability analysis and mitigation

An issue was discovered in the WatchAnalytics extension in MediaWiki before 1.40.2 that allows Cross-Site Scripting (XSS) attacks via the Special:PageStatistics page parameter. The vulnerability was assigned CVE-2024-23177 and was disclosed in January 2024 (NVD, CVE).

The vulnerability has been classified with a CVSS v3.1 Base Score of 6.1 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability is network exploitable, requires low attack complexity, needs no privileges, requires user interaction, has changed scope, and can impact confidentiality and integrity but not availability (NVD).

The XSS vulnerability could allow attackers to execute malicious scripts in the context of the user's browser session when accessing the Special:PageStatistics page. This could potentially lead to theft of sensitive information, session hijacking, or other client-side attacks (NVD).

Users are advised to upgrade to MediaWiki version 1.40.2 or later which contains the fix for this vulnerability. The patch has been included in the security release along with other maintenance updates (Wikimedia).