We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.

Please see our statement on Data Privacy.

Crisp.chat (Helpdesk and Chat)

Ok

THREATINT
PUBLISHED

CVE-2024-47849

Backticks can allow the usage of not-allowed SQL functions



Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

Reserved 2024-10-03 | Published 2024-10-05 | Updated 2024-10-07 | Assigner wikimedia-foundation


HIGH: 8.8CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
unaffected

3.6.x before 3.6.1
affected

Credits

Yaron_Koren finder

BlankEclair finder

References

gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1055963

phabricator.wikimedia.org/T370632

phabricator.wikimedia.org/T368628

cve.org (CVE-2024-47849)

nvd.nist.gov (CVE-2024-47849)

Download JSON

Share this page
https://cve.threatint.com/CVE/CVE-2024-47849

Support options

Helpdesk Chat, Email, Knowledgebase
Telegram Chat
Subscribe to our newsletter to learn more about our work.