An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before…

published 2024-05-05 2y ago modified 2026-06-17 4mo ago also BIT-mediawiki-2024-34507 , EUVD-2024-34833

cvss: 7.4; version 3.1, CNA
cisa kev: Not listed; not in CISA's catalog
epss: 0.7%; EPSS 0.7% chance of exploitation in 30 days, percentile 52%
public exploits: 0; none known

An issue was discovered in includes/CommentFormatter/CommentParser.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. XSS can occur because of mishandling of the 0x1b character, as demonstrated by Special:RecentChanges#%1b0000000.

Patch / fix

fixed in 2 distros 1

bitnami mediawiki 1.41.1
mediawiki mediawiki 1.39.7, 1.40.3, 1.41.1

mediawiki Debian 12 1:1.39.7-1~deb12u1
mediawiki Debian 14, Debian 13 1:1.39.7-1

debian advisories DEBIAN-CVE-2024-34507

Is CVE-2024-34507 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2024-34507 updated 2025-11-21 cvss 5.3

mediawiki: cross-site scripting

Red Hat OpenShift Container Platform 3.11 mediawiki
affected: no fix planned “Out of support scope”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation: Proof of concept is public
Automatable: no
Technical impact: partial
Assessed: 2y ago (2024-05-07)

Exploit prediction

0.67% chance of exploitation in the next 30 days, higher than 52% of all scored CVEs (FIRST EPSS, 2026-11-11).

Exploits and checks

phabricator.wikimedia.org https://phabricator.wikimedia.org/T355538 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
CISA ADP	3.1	7.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
CNA	3.1	7.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N
OSV	3.1	7.4	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
bitnami	mediawiki	<1.41.1	1.41.1

Affected products

mediawiki mediawiki

Classification

Weakness

CWE-80 Improper Neutralization of Script-Related HTML Tags in a Web Page

References

phabricator.wikimedia.org /T355538
exploit, issue-tracking, vendor-advisory, web
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/
vendor-advisory, third-party-advisory, web
lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/
web
nvd.nist.gov /vuln/detail/CVE-2024-34507
web

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.