PT-2024-20753 · Mediawiki · Managewiki

Agentisai + 1 · Published 2024-02-09 · Updated 2024-09-05 · CVE-2024-25109

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions ManageWiki (affected versions not specified)

Description ManageWiki is a MediaWiki extension that allows users to manage wikis. The issue arises because Special:ManageWiki does not properly escape interface messages on the columns and help keys on the form descriptor. This oversight can be exploited by an attacker to launch a cross-site scripting attack. To exploit this vulnerability on-wiki, the attacker would need to have the (editinterface) right.

Recommendations To resolve this vulnerability, users should apply the code changes in commits 886cc6b94, 2ef0f50880, and 6942e8b2c. As a temporary workaround, consider restricting access to the Special:ManageWiki page until the code changes are applied. Avoid using the columns and help keys on the form descriptor in the affected ManageWiki extension until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-25109

GHSA-4JR2-JHFM-2R84

Affected Products

Managewiki

References · 11

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25109.json · Exploit
• https://github.com/miraheze/ManageWiki/security/advisories/GHSA-4jr2-jhfm-2r84 · Vendor Advisory
• https://github.com/miraheze/ManageWiki/commit/2ef0f50880d7695ca2874dc8dd515b2b9bbb02e5 · Patch
• https://github.com/miraheze/ManageWiki/commit/6942e8b2c01dc33c2c41a471f91ef3f6ca726073 · Patch
• https://github.com/miraheze/ManageWiki/commit/886cc6b94587f1c7387caa26ca9fe612e01836a0 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2024-25109 · Security Note
• https://osv.dev/vulnerability/CVE-2024-25109 · Vendor Advisory
• https://t.me/cvenotify/93322 · Telegram Post
• https://twitter.com/CVEnew/status/1756085867569946847 · Twitter Post
• https://issue-tracker.miraheze.org/T11812 · Note
• https://twitter.com/VulmonFeeds/status/1756127236963340770 · Twitter Post