CyberRota Analysis
AI-GeneratedThe EmbedVideo Extension for MediaWiki versions prior to 4.1.0 is vulnerable due to improper sanitization of video URLs in the iframe src attribute, which can lead to HTML/JavaScript injection when a malformed URL is provided. This vulnerability poses a significant risk as it could allow attackers to execute arbitrary scripts on affected sites. Organizations using this extension should prioritize upgrading to version 4.1.0 or later to mitigate potential exploitation.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
The EmbedVideo Extension is a MediaWiki extension which adds a parser function called #ev and various parser tags for embedding video clips from various video sharing services. Prior to 4.1.0, with $wgEmbedVideoRequireConsent disabled (not the default), the urls for videos are passed into an iframe src attribute without sanitization. When given a malformed url or id, the src attribute can be escaped via double quotes, allowing for html/javascript injection. Version 4.1.0 contains a patch.