PT-2024-32845 · Mediawiki · Mediawiki

R4356Th · Published 2024-10-04 · Updated 2024-10-16 · CVE-2024-47840

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mediawiki - Apex skin versions 1.39.X through 1.39.8 Mediawiki - Apex skin versions 1.41.X through 1.41.2 Mediawiki - Apex skin versions 1.42.X through 1.42.1

Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting (XSS). This allows for Stored XSS, where an attacker can inject malicious scripts into the website, potentially affecting users who access the compromised page.

Recommendations For Mediawiki - Apex skin versions 1.39.X through 1.39.8, update to version 1.39.9 or later. For Mediawiki - Apex skin versions 1.41.X through 1.41.2, update to version 1.41.3 or later. For Mediawiki - Apex skin versions 1.42.X through 1.42.1, update to version 1.42.2 or later.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-47840

Affected Products

Mediawiki

References · 10

• 🔥 https://phabricator.wikimedia.org/T370081 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-47840 · Security Note
• https://osv.dev/vulnerability/CVE-2024-47840 · Vendor Advisory
• https://phabricator.wikimedia.org/T368628 · Vendor Advisory
• https://gerrit.wikimedia.org/r/q/Id9093783051c3f8e6dcb5dc89f9493a5f5cf7bd7 · Patch
• https://twitter.com/CVEnew/status/1842391950902862096 · Twitter Post
• https://t.me/cvedetector/7033 · Telegram Post
• https://t.me/cvenotify/98327 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1842444332428644480 · Twitter Post
• https://t.me/cvenotify/97105 · Telegram Post