CVE-2024-47815

Description

IncidentReporting is a MediaWiki extension for moving incident reports from wikitext to database tables. There are a variety of Cross-site Scripting issues, though all of them require elevated permissions. Some are available to anyone who has the `editincidents` right, some are available to those who can edit interface messages (typically administrators and interface admins), and one is available to those who can edit LocalSettings.php. These issues have been addressed in commit `43896a4` and all users are advised to upgrade. Users unable to upgrade should prevent access to the Special:IncidentReports page.

Reserved 2024-10-03 | Published 2024-10-09 | Updated 2024-10-09 | Assigner GitHub_M

Problem types

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Product status

commits prior to 43896a4
affected

References

github.com/...orting/security/advisories/GHSA-9p36-hrmr-98r9

github.com/...ommit/43896a47de4e05ac94ec0472c220da944da16c5c

issue-tracker.miraheze.org/T12702

cve.org (CVE-2024-47815)

nvd.nist.gov (CVE-2024-47815)

Download JSON