CVE-2024-47782CWE-79CWE-80

Cross-site Scripting (XSS) in Special:WikiDiscover when displaying wiki information in WikiDiscover

High · published October 7, 2024

CVSS v3.1
7.6
EPSS
0%
Percentile
26.0
In the wild
Unconfirmed
What it is

WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. Special:WikiDiscover is a special page that lists all wikis on the wiki farm. However, the special page does not make any effort to escape the wiki name or description. Therefore, if a wiki sets its name and/or description to an XSS payload, the XSS will execute whenever the wiki is shown on Special:WikiDiscover. This issue has been patched with commit `2ce846dd93` and all users are advised to apply that patch. User unable to upgrade should block access to `Special:WikiDiscover`.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L
CVSS v4.0
Not supplied
EPSS
0.00338 · 26.0th percentile
Weaknesses
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting'); CWE-80 · Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Published
2024-10-07T21:28Z
EPSS history
Timeline
  • 07 OCT 21:28Z
    Cross-site Scripting (XSS) in Special:WikiDiscover when displaying wiki information in WikiDiscover
    cvelistv5