PT-2024-23107 · Miraheze · Createwiki

Orangestar · Published 2024-03-26 · Updated 2026-01-02 · CVE-2024-29883

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions CreateWiki (affected versions not specified)

Description The issue affects CreateWiki, Miraheze's MediaWiki extension for requesting and creating wikis. Suppression of wiki requests does not work as intended, always restricting visibility to those with the (createwiki) user right regardless of the settings one sets on a given wiki request. This may expose information to users who are not supposed to be able to access it.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2024-29883

GHSA-8WJF-MXJG-J8P9

Affected Products

Createwiki

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/29xxx/CVE-2024-29883.json · Exploit
• 🔥 https://issue-tracker.miraheze.org/T11993 · Exploit
• https://github.com/miraheze/CreateWiki/security/advisories/GHSA-8wjf-mxjg-j8p9 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-29883 · Security Note
• https://osv.dev/vulnerability/CVE-2024-29883 · Vendor Advisory
• https://gist.githubusercontent.com/redbluegreenhat/0da1ebb7185b241ce1ac6ba1e8f0b98d/raw/44c4a229aacc8233808c767a79af9e4fd581ae68/T11993.patch · Patch
• https://t.me/cveNotify/147494 · Telegram Post
• https://t.me/cvenotify/74698 · Telegram Post
• https://twitter.com/CVEnew/status/1772622644912791967 · Twitter Post