CVE-2024-47913 json
Improper permissions handling in MediaWiki AbuseFilter
published 2024-10-04 2 y ago modified 2026-06-17 4 mo ago also EUVD-2024-3175 , GHSA-rmcp-9fhq-58pv
- cvss
- 5.3
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.5%
- EPSS 0.5% chance of exploitation in 30 days, percentile 39%
- public exploits
- 0
- none known
Summary
An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can match a filter condition against AbuseFilter logs even if the caller is not authorized to view the log details for the filter.
Patch / fix
- packagist mediawiki/abuse-filter 1.39.9, 1.41.3, 1.42.2
- mediawiki abusefilter 1.39.9, 1.41.3, 1.42.2
- mediawiki Debian 12 1:1.39.10-1~deb12u1
- mediawiki Debian 14, Debian 13 1:1.39.10-1
debian advisories DEBIAN-CVE-2024-47913
CISA SSVC
- Exploitation
- none
- Automatable
- no
- Technical impact
- partial
- Assessed
- 2 y ago
Exploit prediction
0.45% chance of exploitation in the next 30 days, higher than 39% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- phabricator.wikimedia.org https://phabricator.wikimedia.org/T372998 referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| GitHub | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| CNA | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
Affected packages
| ecosystem | package | affected | fixed in |
|---|---|---|---|
| packagist | mediawiki/abuse-filter | <1.39.9 >=1.40.0, <1.41.3 >=1.42.0, <1.42.2 |
1.39.9 1.41.3 1.42.2 |
Classification
- Weakness
-
- CWE-532 Insertion of Sensitive Information into Log File
References
-
gerrit.wikimedia.org
/r/c/mediawiki/extensions/AbuseFilter/+/1076855
web, patch, vendor-advisory
-
phabricator.wikimedia.org
/T372998
web, exploit, issue-tracking, vendor-advisory
-
nvd.nist.gov
/vuln/detail/CVE-2024-47913
advisory
-
github.com
/wikimedia/mediawiki-extensions-AbuseFilter
package
Sources
- CVE List CVE-2024-47913
- GitHub Advisory GHSA-rmcp-9fhq-58pv
- NVD CVE-2024-47913
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.
CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.