CVE-2023-3550 (published 2023-09-25T15:20:27.351Z)
Mediawiki v1.40.0 does not validate namespaces used in XML files.

Therefore, if the instance administrator allows XML file uploads,

a remote attacker with a low-privileged user account can use this

exploit to become an administrator by sending a malicious link to

the instance administrator.




Affected products: Vendor: MediaWiki
Product: MediaWiki
Versions: 1.40.0