CVE-2024-47612CWE-79CWE-80

XSS in Special:DataDump when displaying dump status

Low · published October 2, 2024

CVSS v3.1
3.5
EPSS
0%
Percentile
25.7
In the wild
Unconfirmed
What it is

DataDump is a MediaWiki extension that provides dumps of wikis. Several interface messages are unescaped (more specifically, (datadump-table-column-queued), (datadump-table-column-in-progress), (datadump-table-column-completed), (datadump-table-column-failed)). If these messages are edited (which requires the (editinterface) right by default), anyone who can view Special:DataDump (which requires the (view-dump) right by default) can be XSSed. This vulnerability is fixed with 601688ee8e8808a23b102fa305b178f27cbd226d.

The record
Technical detail
CVSS v3.1
3.5 · LOW
Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00335 · 25.7th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2024-10-02T14:22Z
EPSS history
Timeline
  • 02 OCT 14:22Z
    XSS in Special:DataDump when displaying dump status
    cvelistv5