CVE-2024-47847

Description

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

Reserved 2024-10-03 | Published 2024-10-05 | Updated 2024-10-07 | Assigner wikimedia-foundation

Problem types

CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')

Product status

Default status
unaffected

3.6.x before 3.6.1
affected

Credits

Yaron_Koren finder

BlankEclair finder

References

phabricator.wikimedia.org/T372211

phabricator.wikimedia.org/T368628

gerrit.wikimedia.org/...mediawiki/extensions/Cargo/+/1063804

gerrit.wikimedia.org/...mediawiki/extensions/Cargo/+/1063806

gerrit.wikimedia.org/...mediawiki/extensions/Cargo/+/1063827

gerrit.wikimedia.org/...mediawiki/extensions/Cargo/+/1063831

cve.org (CVE-2024-47847)

nvd.nist.gov (CVE-2024-47847)

Download JSON