Vulnerability-Lookup

CVE-2024-47848 (GCVE-0-2024-47848)

Vulnerability from cvelistv5 – Published: 2024-10-04 23:53 – Updated: 2024-10-07 17:42

Title

User can review/unreview articles while blocked

Summary

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - PageTriage allows Authentication Bypass.This issue affects Mediawiki - PageTriage: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2024-10-07 17:40 UTC

CWE

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor

Assigner

wikimedia-foundation mitre root

References

3 references

URL	Tags
https://phabricator.wikimedia.org/T368628
https://phabricator.wikimedia.org/T366991
https://gerrit.wikimedia.org/r/q/I0288a715f7040a1…

Impacted products

2 products

Vendor	Product	Version	CPE status
The Wikimedia Foundation	Mediawiki - PageTriage	Affected: 1.39.x , < 1.39.9 (semver) Affected: 1.41.x , < 1.41.3 (semver) Affected: 1.42.x , < 1.42.2 (semver)	guessed
wikimedia	pagetriage	Affected: 1.39.0 , < 1.39.9 (semver) Affected: 1.41.0 , < 1.41.3 (semver) Affected: 1.42.0 , < 1.42.2 (semver) cpe:2.3:a:wikimedia:pagetriage::::::::

Date Public

2024-10-04 23:45

Credits

soda

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "affected": [
          {
            "cpes": [
              "cpe:2.3:a:wikimedia:pagetriage:*:*:*:*:*:*:*:*"
            ],
            "defaultStatus": "unaffected",
            "product": "pagetriage",
            "vendor": "wikimedia",
            "versions": [
              {
                "lessThan": "1.39.9",
                "status": "affected",
                "version": "1.39.0",
                "versionType": "semver"
              },
              {
                "lessThan": "1.41.3",
                "status": "affected",
                "version": "1.41.0",
                "versionType": "semver"
              },
              {
                "lessThan": "1.42.2",
                "status": "affected",
                "version": "1.42.0",
                "versionType": "semver"
              }
            ]
          }
        ],
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2024-47848",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-10-07T17:40:11.469713Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-10-07T17:42:12.428Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Mediawiki - PageTriage",
          "vendor": "The Wikimedia Foundation",
          "versions": [
            {
              "lessThan": "1.39.9",
              "status": "affected",
              "version": "1.39.x",
              "versionType": "semver"
            },
            {
              "lessThan": "1.41.3",
              "status": "affected",
              "version": "1.41.x",
              "versionType": "semver"
            },
            {
              "lessThan": "1.42.2",
              "status": "affected",
              "version": "1.42.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "credits": [
        {
          "lang": "en",
          "type": "finder",
          "value": "soda"
        }
      ],
      "datePublic": "2024-10-04T23:45:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "supportingMedia": [
            {
              "base64": false,
              "type": "text/html",
              "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - PageTriage allows Authentication Bypass.\u003cp\u003eThis issue affects Mediawiki - PageTriage: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.\u003c/p\u003e"
            }
          ],
          "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - PageTriage allows Authentication Bypass.This issue affects Mediawiki - PageTriage: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2."
        }
      ],
      "impacts": [
        {
          "capecId": "CAPEC-115",
          "descriptions": [
            {
              "lang": "en",
              "value": "CAPEC-115 Authentication Bypass"
            }
          ]
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "Automatable": "NOT_DEFINED",
            "Recovery": "NOT_DEFINED",
            "Safety": "NOT_DEFINED",
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "providerUrgency": "NOT_DEFINED",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "LOW",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "valueDensity": "NOT_DEFINED",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE",
            "vulnerabilityResponseEffort": "NOT_DEFINED"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-200",
              "description": "CWE-200 Exposure of Sensitive Information to an Unauthorized Actor",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2024-10-04T23:53:50.766Z",
        "orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
        "shortName": "wikimedia-foundation"
      },
      "references": [
        {
          "url": "https://phabricator.wikimedia.org/T368628"
        },
        {
          "url": "https://phabricator.wikimedia.org/T366991"
        },
        {
          "url": "https://gerrit.wikimedia.org/r/q/I0288a715f7040a14ab7f70b2888fe1ef77a44588"
        }
      ],
      "source": {
        "discovery": "UNKNOWN"
      },
      "title": "User can review/unreview articles while blocked",
      "x_generator": {
        "engine": "Vulnogram 0.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
    "assignerShortName": "wikimedia-foundation",
    "cveId": "CVE-2024-47848",
    "datePublished": "2024-10-04T23:53:50.766Z",
    "dateReserved": "2024-10-03T23:44:16.836Z",
    "dateUpdated": "2024-10-07T17:42:12.428Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2024-47848",
      "date": "2026-09-15",
      "epss": "0.00523",
      "percentile": "0.42936"
    },
    "fkie_nvd": {
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - PageTriage allows Authentication Bypass.This issue affects Mediawiki - PageTriage: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.\"}, {\"lang\": \"es\", \"value\": \"La vulnerabilidad de exposici\\u00f3n de informaci\\u00f3n confidencial a un actor no autorizado en The Wikimedia Foundation Mediawiki - PageTriage permite la omisi\\u00f3n de la autenticaci\\u00f3n. Este problema afecta a Mediawiki - PageTriage: desde 1.39.X hasta 1.39.9, desde 1.41.X hasta 1.41.3, desde 1.42.X hasta 1.42.2.\"}]",
      "id": "CVE-2024-47848",
      "lastModified": "2024-10-07T17:48:28.117",
      "metrics": "{\"cvssMetricV40\": [{\"source\": \"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\", \"type\": \"Secondary\", \"cvssData\": {\"version\": \"4.0\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\", \"baseScore\": 6.9, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"vulnerableSystemConfidentiality\": \"LOW\", \"vulnerableSystemIntegrity\": \"NONE\", \"vulnerableSystemAvailability\": \"NONE\", \"subsequentSystemConfidentiality\": \"LOW\", \"subsequentSystemIntegrity\": \"NONE\", \"subsequentSystemAvailability\": \"NONE\", \"exploitMaturity\": \"NOT_DEFINED\", \"confidentialityRequirements\": \"NOT_DEFINED\", \"integrityRequirements\": \"NOT_DEFINED\", \"availabilityRequirements\": \"NOT_DEFINED\", \"modifiedAttackVector\": \"NOT_DEFINED\", \"modifiedAttackComplexity\": \"NOT_DEFINED\", \"modifiedAttackRequirements\": \"NOT_DEFINED\", \"modifiedPrivilegesRequired\": \"NOT_DEFINED\", \"modifiedUserInteraction\": \"NOT_DEFINED\", \"modifiedVulnerableSystemConfidentiality\": \"NOT_DEFINED\", \"modifiedVulnerableSystemIntegrity\": \"NOT_DEFINED\", \"modifiedVulnerableSystemAvailability\": \"NOT_DEFINED\", \"modifiedSubsequentSystemConfidentiality\": \"NOT_DEFINED\", \"modifiedSubsequentSystemIntegrity\": \"NOT_DEFINED\", \"modifiedSubsequentSystemAvailability\": \"NOT_DEFINED\", \"safety\": \"NOT_DEFINED\", \"automatable\": \"NOT_DEFINED\", \"recovery\": \"NOT_DEFINED\", \"valueDensity\": \"NOT_DEFINED\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\", \"providerUrgency\": \"NOT_DEFINED\"}}]}",
      "published": "2024-10-05T00:15:02.800",
      "references": "[{\"url\": \"https://gerrit.wikimedia.org/r/q/I0288a715f7040a14ab7f70b2888fe1ef77a44588\", \"source\": \"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\"}, {\"url\": \"https://phabricator.wikimedia.org/T366991\", \"source\": \"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\"}, {\"url\": \"https://phabricator.wikimedia.org/T368628\", \"source\": \"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\"}]",
      "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
      "vulnStatus": "Awaiting Analysis",
      "weaknesses": "[{\"source\": \"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\", \"type\": \"Secondary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-200\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2024-47848\",\"sourceIdentifier\":\"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\",\"published\":\"2024-10-05T00:15:02.800\",\"lastModified\":\"2026-06-17T07:57:51.403\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - PageTriage allows Authentication Bypass.This issue affects Mediawiki - PageTriage: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.\"},{\"lang\":\"es\",\"value\":\"La vulnerabilidad de exposici\u00f3n de informaci\u00f3n confidencial a un actor no autorizado en The Wikimedia Foundation Mediawiki - PageTriage permite la omisi\u00f3n de la autenticaci\u00f3n. Este problema afecta a Mediawiki - PageTriage: desde 1.39.X hasta 1.39.9, desde 1.41.X hasta 1.41.3, desde 1.42.X hasta 1.42.2.\"}],\"affected\":[{\"source\":\"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\",\"affectedData\":[{\"vendor\":\"The Wikimedia Foundation\",\"product\":\"Mediawiki - PageTriage\",\"defaultStatus\":\"unaffected\",\"versions\":[{\"version\":\"1.39.x\",\"lessThan\":\"1.39.9\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"1.41.x\",\"lessThan\":\"1.41.3\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"1.42.x\",\"lessThan\":\"1.42.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"affectedData\":[{\"vendor\":\"wikimedia\",\"product\":\"pagetriage\",\"defaultStatus\":\"unaffected\",\"cpes\":[\"cpe:2.3:a:wikimedia:pagetriage:*:*:*:*:*:*:*:*\"],\"versions\":[{\"version\":\"1.39.0\",\"lessThan\":\"1.39.9\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"1.41.0\",\"lessThan\":\"1.41.3\",\"versionType\":\"semver\",\"status\":\"affected\"},{\"version\":\"1.42.0\",\"lessThan\":\"1.42.2\",\"versionType\":\"semver\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":6.9,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"NONE\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"LOW\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"LOW\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2024-10-07T17:40:11.469713Z\",\"id\":\"CVE-2024-47848\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-200\"}]}],\"references\":[{\"url\":\"https://gerrit.wikimedia.org/r/q/I0288a715f7040a14ab7f70b2888fe1ef77a44588\",\"source\":\"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\"},{\"url\":\"https://phabricator.wikimedia.org/T366991\",\"source\":\"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\"},{\"url\":\"https://phabricator.wikimedia.org/T368628\",\"source\":\"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\"}]}}",
    "redhat_vex": {
      "current_release_date": "2025-11-21T14:33:00+00:00",
      "cve": "CVE-2024-47848",
      "id": "CVE-2024-47848",
      "initial_release_date": "2024-10-05T00:15:02.800000+00:00",
      "product_status:known_not_affected": "1",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "Mediawiki: User can review/unreview articles while blocked",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-47848.json",
      "version": "3"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2024-47848\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2024-10-07T17:40:11.469713Z\"}}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:wikimedia:pagetriage:*:*:*:*:*:*:*:*\"], \"vendor\": \"wikimedia\", \"product\": \"pagetriage\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.39.0\", \"lessThan\": \"1.39.9\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.41.0\", \"lessThan\": \"1.41.3\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.42.0\", \"lessThan\": \"1.42.2\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2024-10-07T17:42:05.380Z\"}}], \"cna\": {\"title\": \"User can review/unreview articles while blocked\", \"source\": {\"discovery\": \"UNKNOWN\"}, \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"soda\"}], \"impacts\": [{\"capecId\": \"CAPEC-115\", \"descriptions\": [{\"lang\": \"en\", \"value\": \"CAPEC-115 Authentication Bypass\"}]}], \"metrics\": [{\"format\": \"CVSS\", \"cvssV4_0\": {\"Safety\": \"NOT_DEFINED\", \"version\": \"4.0\", \"Recovery\": \"NOT_DEFINED\", \"baseScore\": 6.9, \"Automatable\": \"NOT_DEFINED\", \"attackVector\": \"NETWORK\", \"baseSeverity\": \"MEDIUM\", \"valueDensity\": \"NOT_DEFINED\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N\", \"providerUrgency\": \"NOT_DEFINED\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"NONE\", \"privilegesRequired\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"vulnIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"LOW\", \"vulnConfidentialityImpact\": \"LOW\", \"vulnerabilityResponseEffort\": \"NOT_DEFINED\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"GENERAL\"}]}], \"affected\": [{\"vendor\": \"The Wikimedia Foundation\", \"product\": \"Mediawiki - PageTriage\", \"versions\": [{\"status\": \"affected\", \"version\": \"1.39.x\", \"lessThan\": \"1.39.9\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.41.x\", \"lessThan\": \"1.41.3\", \"versionType\": \"semver\"}, {\"status\": \"affected\", \"version\": \"1.42.x\", \"lessThan\": \"1.42.2\", \"versionType\": \"semver\"}], \"defaultStatus\": \"unaffected\"}], \"datePublic\": \"2024-10-04T23:45:00.000Z\", \"references\": [{\"url\": \"https://phabricator.wikimedia.org/T368628\"}, {\"url\": \"https://phabricator.wikimedia.org/T366991\"}, {\"url\": \"https://gerrit.wikimedia.org/r/q/I0288a715f7040a14ab7f70b2888fe1ef77a44588\"}], \"x_generator\": {\"engine\": \"Vulnogram 0.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - PageTriage allows Authentication Bypass.This issue affects Mediawiki - PageTriage: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.\", \"supportingMedia\": [{\"type\": \"text/html\", \"value\": \"Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - PageTriage allows Authentication Bypass.\u003cp\u003eThis issue affects Mediawiki - PageTriage: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.\u003c/p\u003e\", \"base64\": false}]}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-200\", \"description\": \"CWE-200 Exposure of Sensitive Information to an Unauthorized Actor\"}]}], \"providerMetadata\": {\"orgId\": \"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\", \"shortName\": \"wikimedia-foundation\", \"dateUpdated\": \"2024-10-04T23:53:50.766Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2024-47848\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2024-10-07T17:42:12.428Z\", \"dateReserved\": \"2024-10-03T23:44:16.836Z\", \"assignerOrgId\": \"c4f26cc8-17ff-4c99-b5e2-38fc1793eacc\", \"datePublished\": \"2024-10-04T23:53:50.766Z\", \"assignerShortName\": \"wikimedia-foundation\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.1"
    }
  }
}

FKIE_CVE-2024-47848

Vulnerability from fkie_nvd - Published: 2024-10-05 00:15 - Updated: 2026-06-17 07:57

Severity

6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Summary

References

	URL	Tags
	c4f26cc8-17ff-4c99-b5e2-38fc1793eacc	https://gerrit.wikimedia.org/r/q/I0288a715f7040a14ab7f70b2888fe1ef77a44588
	c4f26cc8-17ff-4c99-b5e2-38fc1793eacc	https://phabricator.wikimedia.org/T366991
	c4f26cc8-17ff-4c99-b5e2-38fc1793eacc	https://phabricator.wikimedia.org/T368628

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "Mediawiki - PageTriage",
          "vendor": "The Wikimedia Foundation",
          "versions": [
            {
              "lessThan": "1.39.9",
              "status": "affected",
              "version": "1.39.x",
              "versionType": "semver"
            },
            {
              "lessThan": "1.41.3",
              "status": "affected",
              "version": "1.41.x",
              "versionType": "semver"
            },
            {
              "lessThan": "1.42.2",
              "status": "affected",
              "version": "1.42.x",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
    },
    {
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:wikimedia:pagetriage:*:*:*:*:*:*:*:*"
          ],
          "defaultStatus": "unaffected",
          "product": "pagetriage",
          "vendor": "wikimedia",
          "versions": [
            {
              "lessThan": "1.39.9",
              "status": "affected",
              "version": "1.39.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.41.3",
              "status": "affected",
              "version": "1.41.0",
              "versionType": "semver"
            },
            {
              "lessThan": "1.42.2",
              "status": "affected",
              "version": "1.42.0",
              "versionType": "semver"
            }
          ]
        }
      ],
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - PageTriage allows Authentication Bypass.This issue affects Mediawiki - PageTriage: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de exposici\u00f3n de informaci\u00f3n confidencial a un actor no autorizado en The Wikimedia Foundation Mediawiki - PageTriage permite la omisi\u00f3n de la autenticaci\u00f3n. Este problema afecta a Mediawiki - PageTriage: desde 1.39.X hasta 1.39.9, desde 1.41.X hasta 1.41.3, desde 1.42.X hasta 1.42.2."
    }
  ],
  "id": "CVE-2024-47848",
  "lastModified": "2026-06-17T07:57:51.403",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "LOW",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-47848",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2024-10-07T17:40:11.469713Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2024-10-05T00:15:02.800",
  "references": [
    {
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
      "url": "https://gerrit.wikimedia.org/r/q/I0288a715f7040a14ab7f70b2888fe1ef77a44588"
    },
    {
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
      "url": "https://phabricator.wikimedia.org/T366991"
    },
    {
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
      "url": "https://phabricator.wikimedia.org/T368628"
    }
  ],
  "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ],
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
      "type": "Secondary"
    }
  ]
}

GHSA-CRH3-9WQ5-G56C

Vulnerability from github – Published: 2024-10-05 00:34 – Updated: 2024-10-05 00:34

Details

Severity

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2024-47848"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2024-10-05T00:15:02Z",
    "severity": "MODERATE"
  },
  "details": "Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - PageTriage allows Authentication Bypass.This issue affects Mediawiki - PageTriage: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.",
  "id": "GHSA-crh3-9wq5-g56c",
  "modified": "2024-10-05T00:34:19Z",
  "published": "2024-10-05T00:34:19Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2024-47848"
    },
    {
      "type": "WEB",
      "url": "https://gerrit.wikimedia.org/r/q/I0288a715f7040a14ab7f70b2888fe1ef77a44588"
    },
    {
      "type": "WEB",
      "url": "https://phabricator.wikimedia.org/T366991"
    },
    {
      "type": "WEB",
      "url": "https://phabricator.wikimedia.org/T368628"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
      "type": "CVSS_V4"
    }
  ]
}

WID-SEC-W-2024-3087

Vulnerability from csaf_certbund - Published: 2024-10-06 22:00 - Updated: 2025-01-19 23:00

Summary

MediaWiki: Mehrere Schwachstellen

Severity

Hoch

Scope

11 vulnerabilities in this advisory, including CVE-2024-47848.

CVE-2024-47848

Es bestehen mehrere Schwachstellen in MediaWiki. Diese Fehler existieren in mehreren Modulen, Widgets und Komponenten wie DataTransfer, Cargo oder PageTriage und anderen. Sie werden durch mehrere sicherheitsrelevante Probleme verursacht, wie z. B. eine SQL-Injektion, ein Path Traversal oder eine unsachgemäße Neutralisierung von Eingaben und mehr. Ein Angreifer kann diese Schwachstellen ausnutzen, um beliebigen Code auszuführen, vertrauliche Informationen offenzulegen, einen Cross-Site-Scripting-Angriff durchzuführen oder Dateien zu manipulieren. Einige dieser Schwachstellen erfordern eine Benutzerinteraktion, um erfolgreich ausgenutzt zu werden.

Known affected: 6 products

Open the full advisory

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2024-47848 (GCVE-0-2024-47848)

FKIE_CVE-2024-47848

GHSA-CRH3-9WQ5-G56C

WID-SEC-W-2024-3087

Tags

Sightings

Nomenclature

Related by attack behaviour