CVE-2024-23176
Received Received - Intake

MassMessage Extension XSS Vulnerability in MediaWiki

Publication date: 2026-09-14

Last updated on: 2026-09-14

Assigner: MITRE

Description
An issue was discovered in the MassMessage extension in MediaWiki before 1.40.2. For a Special:MassMessage?uselang=x-xss URL, the i18n key massmessage-form-page-help allows XSS.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-14
Last Modified
2026-09-14
Generated
2026-09-14
AI Q&A
2026-09-14
EPSS Evaluated
N/A
NVD
CVE-2024-23176
EUVD
EUVD-2024-55763

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
mediawiki massmessage to 1.40.2 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-79 The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

CVE-2024-23176 is a cross-site scripting (XSS) vulnerability in the MediaWiki MassMessage extension. It occurs due to improper handling of the i18n key massmessage-form-page-help, which allows XSS attacks when the $wgUseXssLanguage setting is enabled. The vulnerability arises because HTMLFormField help attributes wrap content in HtmlArmor without proper escaping.

Detection Guidance

To detect this vulnerability, check if your MediaWiki instance uses the MassMessage extension and if the $wgUseXssLanguage setting is enabled. Inspect URLs with uselang=x-xss parameters for XSS payloads in the massmessage-form-page-help i18n key. Review Special:MassMessage pages for improperly escaped content.

Impact Analysis

This vulnerability could allow attackers to inject malicious scripts into web pages viewed by users. If exploited, it may lead to unauthorized actions on behalf of users, data theft, or session hijacking. Users with the MassMessage extension enabled are at risk if the vulnerable setting is active.

Compliance Impact

XSS vulnerabilities can compromise data integrity and confidentiality, potentially violating GDPR and HIPAA requirements for protecting personal and health data. Organizations using MediaWiki with MassMessage may face compliance risks if exploited.

Mitigation Strategies

Upgrade MediaWiki to version 1.39.6, 1.40.2, or 1.41.0 or later. Ensure the MassMessage extension is updated. Disable the $wgUseXssLanguage setting if enabled. Apply patches for REL1_39, REL1_40, REL1_41, master, and wmf branches if using older versions.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2024-23176. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart