PT-2024-32826 · Mediawiki · Incidentreporting

Universal-Omega · Published 2024-10-09 · Updated 2024-10-10 · CVE-2024-47815

Positive Technologies (AI Summary)

CVSS v3.1

6.0

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L

Name of the Vulnerable Software and Affected Versions IncidentReporting versions prior to the version containing commit 43896a4

Description The IncidentReporting MediaWiki extension has multiple Cross-site Scripting issues that require elevated permissions to exploit. These issues affect users with the editincidents right, those who can edit interface messages (typically administrators and interface admins), and those who can edit LocalSettings.php.

Recommendations For versions prior to the version containing commit 43896a4, upgrade to a version that includes commit 43896a4 to resolve the issue. As a temporary workaround for users unable to upgrade, prevent access to the Special:IncidentReports page.

Exploit

Fix

XSS

Weakness Enumeration

CWE-80

CWE-79

Related Identifiers

CVE-2024-47815

GHSA-9P36-HRMR-98R9

Affected Products

Incidentreporting

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47815.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-47815 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47815 · Vendor Advisory
• https://github.com/miraheze/IncidentReporting/commit/43896a47de4e05ac94ec0472c220da944da16c5c · Note
• https://github.com/miraheze/IncidentReporting/security/advisories/GHSA-9p36-hrmr-98r9 · Note
• https://t.me/cvenotify/97676 · Telegram Post
• https://twitter.com/CVEnew/status/1844086633991119168 · Twitter Post
• https://issue-tracker.miraheze.org/T12702 · Note
• https://t.me/cvedetector/7519 · Telegram Post