« Volver al listado

CVE-2024-47612

Estado: AplazadaBaja (3.5)—

DataDump is a MediaWiki extension that provides dumps of wikis. Several interface messages are unescaped (more specifically, (datadump-table-column-queued), (datadump-table-column-in-progress), (datadump-table-column-completed), (datadump-table-column-failed)). If these messages are edited (which requires the (editinterface) right by default), anyone who can view Special:DataDump (which requires the (view-dump) right by default) can be XSSed. This vulnerability is fixed with 601688ee8e8808a23b102fa305b178f27cbd226d.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Mediawiki — DatadumpAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-47612",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-47612",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-02T14:59:00.607636Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "security-advisories@github.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 3.5,
          "attackVector": "NETWORK",
          "baseSeverity": "LOW",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "HIGH",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.5,
        "exploitabilityScore": 0.9
      }
    ]
  },
  "affected": [
    {
      "source": "security-advisories@github.com",
      "affectedData": [
        {
          "vendor": "miraheze",
          "product": "DataDump",
          "versions": [
            {
              "status": "affected",
              "version": "< 601688ee8e8808a23b102fa305b178f27cbd226d"
            }
          ]
        }
      ]
    }
  ],
  "published": "2024-10-02T15:15:15.133",
  "references": [
    {
      "url": "https://github.com/miraheze/DataDump/commit/601688ee8e8808a23b102fa305b178f27cbd226d.patch",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://github.com/miraheze/DataDump/security/advisories/GHSA-h8x8-24c7-r2rj",
      "source": "security-advisories@github.com"
    },
    {
      "url": "https://issue-tracker.miraheze.org/T12670",
      "source": "security-advisories@github.com"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "security-advisories@github.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-80"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "DataDump is a MediaWiki extension that provides dumps of wikis. Several interface messages are unescaped (more specifically, (datadump-table-column-queued), (datadump-table-column-in-progress), (datadump-table-column-completed), (datadump-table-column-failed)). If these messages are edited (which requires the (editinterface) right by default), anyone who can view Special:DataDump (which requires the (view-dump) right by default) can be XSSed. This vulnerability is fixed with 601688ee8e8808a23b102fa305b178f27cbd226d."
    },
    {
      "lang": "es",
      "value": "DataDump es una extensión de MediaWiki que proporciona volcados de wikis. Varios mensajes de interfaz no tienen caracteres de escape (más específicamente, (datadump-table-column-queued), (datadump-table-column-in-progress), (datadump-table-column-completed), (datadump-table-column-failed)). Si se editan estos mensajes (lo que requiere el derecho (editinterface) de forma predeterminada), cualquiera que pueda ver Special:DataDump (que requiere el derecho (view-dump) de forma predeterminada) puede ser víctima de XSS. Esta vulnerabilidad se corrige con 601688ee8e8808a23b102fa305b178f27cbd226d."
    }
  ],
  "lastModified": "2026-06-17T07:57:23.940",
  "sourceIdentifier": "security-advisories@github.com"
}