---

CVE-2017-0365 - log back

CVE-2017-0365 created at 25 Sep 2019 19:31:40
Severity	+ Medium
Remote	+ Remote
Type	+ Cross-site scripting
Description	+ SearchHighlighter::removeWiki() uses a regex to remove html from snippets. The regex - /<\/?[^>]+>/ assumes that html is well-formed. As a result when using SearchHighlighter::highlightText() as the highlighting method, this can result in an XSS when $wgAdvancedSearchHighlighting is true.
References	+ https://phabricator.wikimedia.org/T144845 + https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-April/000207.html
Notes