PT-2024-32847 · Mediawiki · Mediawiki Css Extension

Bawolff + 1 · Published 2024-10-04 · Updated 2024-10-23 · CVE-2024-47845

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mediawiki - CSS Extension versions 1.39.X through 1.39.8 Mediawiki - CSS Extension versions 1.41.X through 1.41.2 Mediawiki - CSS Extension versions 1.42.X through 1.42.1

Description The issue is related to improper encoding or escaping of output, which allows code injection. This is a Code Injection Vulnerability in the Mediawiki CSS Extension.

Recommendations For versions 1.39.X through 1.39.8, update to version 1.39.9 or later. For versions 1.41.X through 1.41.2, update to version 1.41.3 or later. For versions 1.42.X through 1.42.1, update to version 1.42.2 or later.

Exploit

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2024-47845

Affected Products

Mediawiki Css Extension

References · 10

• 🔥 https://phabricator.wikimedia.org/T368594 · Exploit
• https://osv.dev/vulnerability/CVE-2024-47845 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-47845 · Security Note
• https://phabricator.wikimedia.org/T368628 · Vendor Advisory
• https://gerrit.wikimedia.org/r/q/I6f38f4a8fc1dcd690ab27b8f18ce6ca903bacc53 · Patch
• https://t.me/cvedetector/7035 · Telegram Post
• https://t.me/cvenotify/99180 · Telegram Post
• https://twitter.com/CVEnew/status/1842371343116906901 · Twitter Post
• https://t.me/cvenotify/97106 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1842445613046083849 · Twitter Post