CVE-2024-47612 XSS in Special:DataDump when displaying dump status
An attacker with interface editing rights can inject malicious scripts into DataDump status messages, affecting users viewing the dump page.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2024-47612?
CVE-2024-47612 is a low-severity cross-site scripting vulnerability in miraheze DataDump, published on 2 Oct 2024. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
DataDump is a MediaWiki extension that provides dumps of wikis. Several interface messages are unescaped (more specifically, (datadump-table-column-queued), (datadump-table-column-in-progress), (datadump-table-column-completed), (datadump-table-column-failed)). If these messages are edited (which requires the (editinterface) right by default), anyone who can view Special:DataDump (which requires the (view-dump) right by default) can be XSSed. This vulnerability is fixed with 601688ee8e8808a23b102fa305b178f27cbd226d.
Which versions are affected by CVE-2024-47612?
How do I fix CVE-2024-47612?
No fix has been published for CVE-2024-47612 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2024-47612 being exploited?
There is no known exploitation of CVE-2024-47612 in the wild and no public exploit code.
Sources
Also known as GHSA-h8x8-24c7-r2rj.