CVE-2024-40605: 
NixOS vulnerability analysis and mitigation

A stored Cross-Site Scripting (XSS) vulnerability was discovered in the Foreground skin for MediaWiki through version 1.42.1. The vulnerability allows attackers to execute malicious code via MediaWiki:Sidebar top-level menu entries (NIST NVD, MITRE CVE).

The vulnerability has been assigned a CVSS v3.1 base score of 4.8 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires high privileges to exploit, requires user interaction, and can potentially lead to limited confidentiality and integrity impacts (NIST NVD).

The vulnerability allows attackers with high privileges to inject malicious code through MediaWiki:Sidebar top-level menu entries, which could lead to the execution of unauthorized scripts in users' browsers when they view affected pages (NIST NVD).

The vulnerability requires high privileges to exploit and user interaction for successful execution. An exploit has been documented in the Wikimedia Phabricator issue tracking system (Wikimedia Phabricator).

Users should upgrade to a version of MediaWiki that contains the fix for this vulnerability. The issue affects MediaWiki through version 1.42.1 (NIST NVD).