Wikimedia CSS Extension up to 1.39.8/1.41.2/1.42.1 on Mediawiki escape output

Summaryinfo

A vulnerability, which was classified as critical, was found in Wikimedia CSS Extension up to 1.39.8/1.41.2/1.42.1 on Mediawiki. The affected element is an unknown function. Executing a manipulation can lead to escape output. The identification of this vulnerability is CVE-2024-47845. The attack may be launched remotely. There is no exploit available. You should upgrade the affected component.

Detailsinfo

A vulnerability has been found in Wikimedia CSS Extension up to 1.39.8/1.41.2/1.42.1 on Mediawiki and classified as critical. This vulnerability affects some unknown functionality. The manipulation with an unknown input leads to a escape output vulnerability. The CWE definition for the vulnerability is CWE-116. The product prepares a structured message for communication with another component, but encoding or escaping of the data is either missing or done incorrectly. As a result, the intended structure of the message is not preserved. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Code Injection.This issue affects Mediawiki - CSS Extension: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

The weakness was shared by Blankeclair. The advisory is available at phabricator.wikimedia.org. This vulnerability was named CVE-2024-47845 since 10/04/2024. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available.

Upgrading to version 1.39.9, 1.41.3 or 1.42.2 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Content Management System

Vendor

• Wikimedia

Name

• CSS Extension

Version

• 1.39.0
• 1.39.1
• 1.39.2
• 1.39.3
• 1.39.4
• 1.39.5
• 1.39.6
• 1.39.7
• 1.39.8
• 1.41.0
• 1.41.1
• 1.41.2
• 1.42.0
• 1.42.1

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion