CVE-2024-36123: Citizen has a Stored Cross-Site Scripting Vulnerability by editing MediaWiki:Tagline
Vulnerability summary
CVE-2024-36123 is a medium (CVSS 6.5) Cross-site Scripting vulnerability in starcitizen.tools citizen. EPSS estimates a 0.47% chance of exploitation in the next 30 days, higher than 39.8% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 03-06-2024PublishedVulnerability first disclosed.
- 02-08-2024Last modifiedVulnerability information updated.
Description
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. The page `MediaWiki:Tagline` has its contents used unescaped, so custom HTML (including Javascript) can be injected by someone with the ability to edit the MediaWiki namespace (typically those with the `editinterface` permission, or sysops). This vulnerability is fixed in 2.16.0.
CVSS metrics
3 scores · 3 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
- NVDNIST5.4MediumCVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:NDiffers
EPSS trend
Probability
0.47%
Chance of exploitation in the next 30 days
Percentile
40%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.47% on 22-09-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundMediawiki Skins Citizen
Maturity: poc
Weaknesses
CWE · root causeAffected systems
Starcitizen.tools1 product
- citizen< 2.16.0
Starcitizentools1 product
- mediawiki-skins-citizen< 2.16.0
Ubuntu1 product
- mediawikiAll versions (No fix recorded)
3 vendors · 3 products
References
7 links- github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-jhm6-qjhq-5mf9X Refsource CONFIRMREPORTExploitVendor Advisory
- github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/4a43280242f33e54643087da4a7f40970d2640c9X Refsource MISCREPORTPatch