CVE-2024-47816

{
  "id": "CVE-2024-47816",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-47816",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-09T19:44:13.313675Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 1.6
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "miraheze",
          "product": "ImportDump",
          "versions": [
            {
              "status": "affected",
              "version": "commits prior to 5c91dfc"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-10-09T19:15:14.227",
  "references": [
    {
      "url": "https://github.com/miraheze/ImportDump/commit/5c91dfce78320e717516ee65ef5a05f01979ee6c",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/miraheze/ImportDump/security/advisories/GHSA-jjmq-mg36-6387",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/miraheze/mw-config/commit/e5664995fbb8644f9a80b450b4326194f20f9ddc",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://issue-tracker.miraheze.org/T12701",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-282"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "ImportDump is a mediawiki extension designed to automate user import requests. A user's local actor ID is stored in the database to tell who made what requests. Therefore, if a user on another wiki happens to have the same actor ID as someone on the central wiki, the user on the other wiki can act as if they're the original wiki requester. This can be abused to create new comments, edit the request, and view the request if it's marked private. This issue has been addressed in commit `5c91dfc` and all users are advised to update. Users unable to update may disable the special page outside of their global wiki. See `miraheze/mw-config@e566499` for details on that."
    },
    {
      "lang": "es",
      "value": "ImportDump es una extensión de MediaWiki diseñada para automatizar las solicitudes de importación de los usuarios. El ID de actor local de un usuario se almacena en la base de datos para indicar quién realizó qué solicitudes. Por lo tanto, si un usuario de otra wiki tiene el mismo ID de actor que alguien de la wiki central, el usuario de la otra wiki puede actuar como si fuera el solicitante original de la wiki. Esto se puede aprovechar para crear nuevos comentarios, editar la solicitud y ver la solicitud si está marcada como privada. Este problema se ha solucionado en el commit `5c91dfc` y se recomienda a todos los usuarios que actualicen. Los usuarios que no puedan actualizar pueden deshabilitar la página especial fuera de su wiki global. Consulte `miraheze/mw-config@e566499` para obtener más detalles al respecto."
    }
  ],
  "lastModified": "2026-06-17T07:57:48.323",
  "sourceIdentifier": "security-advisories@github.com"
}