CVE-2023-3550

HighCVSS 7.3/10Last modified Jun 17, 2026

Description

Mediawiki v1.40.0 does not validate namespaces used in XML files.

Therefore, if the instance administrator allows XML file uploads,

a remote attacker with a low-privileged user account can use this

exploit to become an administrator by sending a malicious link to

the instance administrator.

Metrics

CVSS 3.1 7.3/10CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N

Weakness enumeration

CWE-79

Affected software

No affected versions have been published.

Timeline

Published
Sep 25, 2023
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2023

CVE-2023-35517.2Code Injection in GitHub repository nilsteampassnet/teampass prior to 3.0.10.CVE-2023-35525.4Improper Encoding or Escaping of Output in GitHub repository nilsteampassnet/teampass prior to 3.0.10.CVE-2023-35537.5Exposure of Sensitive Information to an Unauthorized Actor in GitHub repository nilsteampassnet/teampass prior to 3.0.10.CVE-2023-35546.1A vulnerability was found in GZ Scripts GZ Forum Script 1.8 and classified as problematic. Affected by this issue is some unknown functionalCVE-2023-35556.1A vulnerability was found in GZ Scripts PHP Vacation Rental Script 1.8. It has been classified as problematic. This affects an unknown part CVE-2023-35566.1A vulnerability was found in GZ Scripts Car Listing Script PHP 1.8. It has been declared as problematic. This vulnerability affects unknown CVE-2023-35576.1A vulnerability was found in GZ Scripts Property Listing Script 1.0. It has been rated as problematic. This issue affects some unknown proceCVE-2023-35585.4A vulnerability classified as problematic has been found in GZ Scripts Event Booking Calendar 1.8. Affected is an unknown function of the fiCVE-2023-35596.1A vulnerability classified as problematic was found in GZ Scripts PHP GZ Appointment Scheduling Script 1.8. Affected by this vulnerability iCVE-2023-35606.1A vulnerability, which was classified as problematic, has been found in GZ Scripts Ticket Booking Script 1.8. Affected by this issue is someCVE-2023-35616.1A vulnerability, which was classified as problematic, was found in GZ Scripts PHP GZ Hotel Booking Script 1.8. This affects an unknown part CVE-2023-356189.6Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2023-3550: High severity, CVSS 7.3 | Vulnix