CVE-2024-47849

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

Reserved 2024-10-03 | Published 2024-10-05 | Updated 2024-10-07 | Assigner wikimedia-foundation

Problem types

CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

Product status

Default status
unaffected

3.6.x before 3.6.1
affected

Credits

Yaron_Koren finder

BlankEclair finder

References

gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1055963

phabricator.wikimedia.org/T370632

phabricator.wikimedia.org/T368628

cve.org (CVE-2024-47849)

nvd.nist.gov (CVE-2024-47849)

Download JSON