PT-2024-32673 · Mediawiki · Datadump

Blankeclair · Published 2024-10-02 · Updated 2024-10-04 · CVE-2024-47612

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Low

Base vector

AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions DataDump versions prior to 601688ee8e8808a23b102fa305b178f27cbd226d

Description The DataDump MediaWiki extension has a security issue due to unescaped interface messages, specifically datadump-table-column-queued, datadump-table-column-in-progress, datadump-table-column-completed, and datadump-table-column-failed. If these messages are edited, which requires the editinterface right by default, users who can view Special:DataDump, requiring the view-dump right by default, can be affected by a cross-site scripting (XSS) attack.

Recommendations For versions prior to 601688ee8e8808a23b102fa305b178f27cbd226d, update to a version that includes the fix 601688ee8e8808a23b102fa305b178f27cbd226d to resolve the issue. As a temporary workaround, consider restricting the editinterface right to prevent unauthorized editing of interface messages, and limit access to Special:DataDump to minimize the risk of exploitation.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2024-47612

GHSA-H8X8-24C7-R2RJ

Affected Products

Datadump

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47612.json · Exploit
• https://osv.dev/vulnerability/CVE-2024-47612 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47612 · Security Note
• https://github.com/miraheze/DataDump/commit/601688ee8e8808a23b102fa305b178f27cbd226d.patch · Note
• https://github.com/miraheze/DataDump/security/advisories/GHSA-h8x8-24c7-r2rj · Note
• https://t.me/cvedetector/6831 · Telegram Post
• https://issue-tracker.miraheze.org/T12670 · Note
• https://twitter.com/VulmonFeeds/status/1841519108770132142 · Twitter Post
• https://twitter.com/CVEnew/status/1841486667275710736 · Twitter Post