« Volver al listado

CVE-2024-47845

Estado: AnalizadaMedia (6.9)—

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Code Injection.This issue affects Mediawiki - CSS Extension: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Wikimedia — Wikimedia-extensions-css

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-47845",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-47845",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "poc"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-07T17:38:06.697274Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 8.2,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 4.7,
        "exploitabilityScore": 2.8
      }
    ],
    "cvssMetricV40": [
      {
        "type": "Secondary",
        "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
        "cvssData": {
          "Safety": "NOT_DEFINED",
          "version": "4.0",
          "Recovery": "NOT_DEFINED",
          "baseScore": 6.9,
          "Automatable": "NOT_DEFINED",
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "exploitMaturity": "NOT_DEFINED",
          "providerUrgency": "NOT_DEFINED",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "privilegesRequired": "NONE",
          "subIntegrityImpact": "LOW",
          "vulnIntegrityImpact": "LOW",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "vulnAvailabilityImpact": "NONE",
          "availabilityRequirement": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "subConfidentialityImpact": "LOW",
          "vulnConfidentialityImpact": "LOW",
          "confidentialityRequirement": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "vulnerabilityResponseEffort": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED"
        }
      }
    ]
  },
  "affected": [
    {
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
      "affectedData": [
        {
          "vendor": "The Wikimedia Foundation",
          "product": "Mediawiki - CSS Extension",
          "versions": [
            {
              "status": "affected",
              "version": "1.39.x",
              "lessThan": "1.39.9",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.41.x",
              "lessThan": "1.41.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.42.x",
              "lessThan": "1.42.2",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    },
    {
      "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
      "affectedData": [
        {
          "cpes": [
            "cpe:2.3:a:wikimedia:mediawiki-extensions-css:*:*:*:*:*:*:*:*"
          ],
          "vendor": "wikimedia",
          "product": "mediawiki-extensions-css",
          "versions": [
            {
              "status": "affected",
              "version": "1.39.0",
              "lessThan": "1.39.9",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.41.0",
              "lessThan": "1.41.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.42.0",
              "lessThan": "1.42.2",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-10-05T01:15:12.237",
  "references": [
    {
      "url": "https://gerrit.wikimedia.org/r/q/I6f38f4a8fc1dcd690ab27b8f18ce6ca903bacc53",
      "tags": [
        "Patch"
      ],
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
    },
    {
      "url": "https://phabricator.wikimedia.org/T368594",
      "tags": [
        "Exploit",
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
    },
    {
      "url": "https://phabricator.wikimedia.org/T368628",
      "tags": [
        "Issue Tracking",
        "Vendor Advisory"
      ],
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
      "description": [
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-116"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Code Injection.This issue affects Mediawiki - CSS Extension: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2."
    },
    {
      "lang": "es",
      "value": "La vulnerabilidad de codificación incorrecta o escape de salida en The Wikimedia Foundation Mediawiki - CSS Extension permite la inyección de código. Este problema afecta a Mediawiki - CSS Extension: desde 1.39.X antes de 1.39.9, desde 1.41.X antes de 1.41.3, desde 1.42.X antes de 1.42.2."
    }
  ],
  "lastModified": "2026-06-17T07:57:51.003",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:wikimedia:wikimedia-extensions-css:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8C84CC2C-175C-43B2-B687-1F3059E25426",
              "versionEndExcluding": "1.39.9",
              "versionStartIncluding": "1.39.0"
            },
            {
              "criteria": "cpe:2.3:a:wikimedia:wikimedia-extensions-css:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3C653764-2F82-4DFA-8679-44040C0EB5CB",
              "versionEndExcluding": "1.41.3",
              "versionStartIncluding": "1.41.0"
            },
            {
              "criteria": "cpe:2.3:a:wikimedia:wikimedia-extensions-css:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38BB6671-A00E-418E-BAD8-BA54401F0E6A",
              "versionEndExcluding": "1.42.2",
              "versionStartIncluding": "1.42.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
}