PT-2024-32849 · Cargo+1 · Cargo+1

Blankeclair + 1 · Published 2024-10-04 · Updated 2024-10-16 · CVE-2024-47847

Positive Technologies (AI Summary)

CVSS v4.0

6.9

Medium

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Name of the Vulnerable Software and Affected Versions Mediawiki - Cargo versions 3.6.X through 3.6.0

Description The issue affects Mediawiki - Cargo, allowing Cross-Site Scripting (XSS). This is due to an Improper Neutralization of Input During Web Page Generation vulnerability.

Recommendations For versions 3.6.X through 3.6.0, update to version 3.6.1 or later to resolve the issue.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-47847

GHSA-JQVM-9XM2-GC38

Affected Products

Cargo

Mediawiki

References · 15

• 🔥 https://phabricator.wikimedia.org/T372211 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-47847 · Security Note
• https://osv.dev/vulnerability/GHSA-jqvm-9xm2-gc38 · Vendor Advisory
• https://phabricator.wikimedia.org/T368628 · Vendor Advisory
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063806 · Patch
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063831 · Patch
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063804 · Patch
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063827 · Patch
• https://osv.dev/vulnerability/CVE-2024-47847 · Vendor Advisory
• https://github.com/wikimedia/mediawiki-extensions-Cargo · Note
• https://t.me/cvenotify/97108 · Telegram Post
• https://t.me/cvenotify/98329 · Telegram Post
• https://twitter.com/CVEnew/status/1842371339522330973 · Twitter Post
• https://t.me/cvedetector/7034 · Telegram Post
• https://twitter.com/VulmonFeeds/status/1842448174293623140 · Twitter Post