CVE-2024-47612

LOW EPSS 22.4%
Published Oct 2, 20241y ago · Modified Jun 17, 20262w ago
3.5 CVSS 3.1
Low
Find Similar
Published Oct 2, 2024 1y ago
Last Modified Jun 17, 2026 2w ago

Description

DataDump is a MediaWiki extension that provides dumps of wikis. Several interface messages are unescaped (more specifically, (datadump-table-column-queued), (datadump-table-column-in-progress), (datadump-table-column-completed), (datadump-table-column-failed)). If these messages are edited (which requires the (editinterface) right by default), anyone who can view Special:DataDump (which requires the (view-dump) right by default) can be XSSed. This vulnerability is fixed with 601688ee8e8808a23b102fa305b178f27cbd226d.

CVSS Details

Base Score
3.5
Exploitability
0.9
Impact
2.5
Vector string
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required High
User Interaction Required
Scope Unchanged
Confidentiality Low
Integrity Low
Availability None

Threat Intelligence

EPSS Exploit Probability
22.4% percentile
Exploit & Patch Status
No Known Exploit
No Patch Available

Weaknesses 2

CWE-79 Cross-site Scripting Injection
CWE-80

References 3

  • github.com https://github.com/miraheze/DataDump/commit/601688ee8e8808a23b102fa305b178f27cbd226d.patch
  • github.com https://github.com/miraheze/DataDump/security/advisories/GHSA-h8x8-24c7-r2rj
  • issue-tracker.miraheze.org https://issue-tracker.miraheze.org/T12670

Remediation

No remediation data recorded yet

Check vendor advisories and the NVD entry for patch availability.