deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2024-47665
Published: 2024-10-09
Description: In the Linux kernel, the following vulnerability has been resolved:

i3c: mipi-i3c-hci: Error out instead on BUG_ON() in IBI DMA setup

Definitely condition dma_get_cache_alignment * defined value > 256
during driver initialization is not reason to BUG_ON(). Turn that to
graceful error out with -EINVAL.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/[PII_REDACTED]bdfedf90d91f4071490ad3980be785; https://git.kernel.org/stable/c/5a022269abb22809f2a174b90f200fc4b9526058; https://git.kernel.org/stable/c/8a2be2f1db268ec735419e53ef04ca039fc027dc
CVE: CVE-2024-47666
Published: 2024-10-09
Description: In the Linux kernel, the following vulnerability has been resolved:

scsi: pm80xx: Set phy->enable_completion only when we wait for it

pm8001_phy_control() populates the enable_completion pointer with a stack
address, sends a PHY_LINK_RESET / PHY_HARD_RESET, waits 300 ms, and
returns. The problem arises when a phy control response comes late.  After
300 ms the pm8001_phy_control() function returns and the passed
enable_completion stack address is no longer valid. Late phy control
response invokes complete() on a dangling enable_completion pointer which
leads to a kernel crash.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-416
References: https://git.kernel.org/stable/c/7b1d779647afaea9185fa2f150b1721e7c1aae89; https://git.kernel.org/stable/c/a5d954802bda1aabcba49633cd94bad91c94113f; https://git.kernel.org/stable/c/ddc501f4130f4baa787cb6cfa309af697179f475
CVE: CVE-2024-47667
Published: 2024-10-09
Description: In the Linux kernel, the following vulnerability has been resolved:

PCI: keystone: Add workaround for Errata #i2037 (AM65x SR 1.0)

Errata #i2037 in AM65x/DRA80xM Processors Silicon Revision 1.0
(SPRZ452D_July 2018_Revised December 2019 [1]) mentions when an
inbound PCIe TLP spans more than two internal AXI 128-byte bursts,
the bus may corrupt the packet payload and the corrupt data may
cause associated applications or the processor to hang.

The workaround for Errata #i2037 is to limit the maximum read
request size and maximum payload size to 128 bytes. Add workaround
for Errata #i2037 here.

The errata and workaround is applicable only to AM65x SR 1.0 and
later versions of the silicon will have this fixed.

[1] -> https://www.ti.com/lit/er/sprz452i/sprz452i.pdf
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/135843c351c08df72bdd4b4ebea53c8052a76881; https://git.kernel.org/stable/c/576d0fb6f8d4bd4695e70eee173a1b9c7bae9572; https://git.kernel.org/stable/c/86f271f22bbb6391410a07e08d6ca3757fda01fa
CVE: CVE-2024-47668
Published: 2024-10-09
Description: In the Linux kernel, the following vulnerability has been resolved:

lib/generic-radix-tree.c: Fix rare race in __genradix_ptr_alloc()

If we need to increase the tree depth, allocate a new node, and then
race with another thread that increased the tree depth before us, we'll
still have a preallocated node that might be used later.

If we then use that node for a new non-root node, it'll still have a
pointer to the old root instead of being zeroed - fix this by zeroing it
in the cmpxchg failure path.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-362
References: https://git.kernel.org/stable/c/0f078f8ca93b28a34e20bd050f12cd4efeee7c0f; https://git.kernel.org/stable/c/0f27f4f445390cb7f73d4209cb2bf32834dc53da; https://git.kernel.org/stable/c/99418ec776a39609f[PII_REDACTED]9e0b464ca2283
CVE: CVE-2024-47669
Published: 2024-10-09
Description: In the Linux kernel, the following vulnerability has been resolved:

nilfs2: fix state management in error path of log writing function

After commit a694291a6211 ("nilfs2: separate wait function from
nilfs_segctor_write") was applied, the log writing function
nilfs_segctor_do_construct() was able to issue I/O requests continuously
even if user data blocks were split into multiple logs across segments,
but two potential flaws were introduced in its error handling.

First, if nilfs_segctor_begin_construction() fails while creating the
second or subsequent logs, the log writing function returns without
calling nilfs_segctor_abort_construction(), so the writeback flag set on
pages/folios will remain uncleared.  This causes page cache operations to
hang waiting for the writeback flag.  For example,
truncate_inode_pages_final(), which is called via nilfs_evict_inode() when
an inode is evicted from memory, will hang.

Second, the NILFS_I_COLLECTED flag set on normal inodes remain uncleared. 
As a result, if the next log write involves checkpoint creation, that's
fine, but if a partial log write is performed that does not, inodes with
NILFS_I_COLLECTED set are erroneously removed from the "sc_dirty_files"
list, and their data and b-tree blocks may not be written to the device,
corrupting the block mapping.

Fix these issues by uniformly calling nilfs_segctor_abort_construction()
on failure of each step in the loop in nilfs_segctor_do_construct(),
having it clean up logs and segment usages according to progress, and
correcting the conditions for calling nilfs_redirty_inodes() to ensure
that the NILFS_I_COLLECTED flag is cleared.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/036441e8438b29111fa75008f0ce305fb4e83c0a; https://git.kernel.org/stable/c/0a1a961bde4351dc047ffdeb2f1311ca16a700cc; https://git.kernel.org/stable/c/30562eff4a6dd35c4b5be9699ef61ad9f5f20a06
CVE: CVE-2024-47670
Published: 2024-10-09
Description: In the Linux kernel, the following vulnerability has been resolved:

ocfs2: add bounds checking to ocfs2_xattr_find_entry()

Add a paranoia check to make sure it doesn't stray beyond valid memory
region containing ocfs2 xattr entries when scanning for a match.  It will
prevent out-of-bound access in case of crafted images.
CVSS Score: 7.8 (HIGH)
CWE: CWE-787
References: https://git.kernel.org/stable/c/1f6e167d6753fe3ea493cdc7f7de8d03147a4d39; https://git.kernel.org/stable/c/34759b7e4493d7337cbc414c132cef378c492a2c; https://git.kernel.org/stable/c/5bbe51eaf01a5dd6fb3f0dea81791e5dbc6dc6dd
CVE: CVE-2024-47671
Published: 2024-10-09
Description: In the Linux kernel, the following vulnerability has been resolved:

USB: usbtmc: prevent kernel-usb-infoleak

The syzbot reported a kernel-usb-infoleak in usbtmc_write,
we need to clear the structure before filling fields.
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0c927dfc0b9bd177f7ab6ee59ef0c4ea06c110a7; https://git.kernel.org/stable/c/16e0ab9ed3ae7d19ca8ee718ba4e09d5c0f909ca; https://git.kernel.org/stable/c/51297ef7ad7824ad577337f273cd092e81a9fa08
CVE: CVE-2024-47672
Published: 2024-10-09
Description: Rejected reason: This CVE ID has been rejected or withdrawn by its CVE Numbering Authority.
CVE: CVE-2024-47673
Published: 2024-10-09
Description: In the Linux kernel, the following vulnerability has been resolved:

wifi: iwlwifi: mvm: pause TCM when the firmware is stopped

Not doing so will make us send a host command to the transport while the
firmware is not alive, which will trigger a WARNING.

bad state = 0
WARNING: CPU: 2 PID: 17434 at drivers/net/wireless/intel/iwlwifi/iwl-trans.c:115 iwl_trans_send_cmd+0x1cb/0x1e0 [iwlwifi]
RIP: 0010:iwl_trans_send_cmd+0x1cb/0x1e0 [iwlwifi]
Call Trace:
 <TASK>
 iwl_mvm_send_cmd+0x40/0xc0 [iwlmvm]
 iwl_mvm_config_scan+0x198/0x260 [iwlmvm]
 iwl_mvm_recalc_tcm+0x730/0x11d0 [iwlmvm]
 iwl_mvm_tcm_work+0x1d/0x30 [iwlmvm]
 process_one_work+0x29e/0x640
 worker_thread+0x2df/0x690
 ? rescuer_thread+0x540/0x540
 kthread+0x192/0x1e0
 ? set_kthread_struct+0x90/0x90
 ret_from_fork+0x22/0x30
CVSS Score: 5.5 (MEDIUM)
References: https://git.kernel.org/stable/c/0668ebc8c2282ca1e7eb96092a347baefffb5fe7; https://git.kernel.org/stable/c/2c61b561baf92a2860c76c2302a62169e22c21cc; https://git.kernel.org/stable/c/55086c97a55d781b04a2667401c75ffde190135c
CVE: CVE-2024-7292
Published: 2024-10-09
Description: In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a credential stuffing attack is possible through improper restriction of excessive login attempts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-307
References: https://docs.telerik.com/report-server/knowledge-base/improper-restriction-of-excessive-login-attempts-cve-2024-7292
CVE: CVE-2024-7293
Published: 2024-10-09
Description: In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), a password brute forcing attack is possible through weak password requirements.
CVSS Score: 7.5 (HIGH)
CWE: CWE-521
References: https://docs.telerik.com/report-server/knowledge-base/weak-password-requirement-cve-2024-7293
CVE: CVE-2024-7294
Published: 2024-10-09
Description: In Progress® Telerik® Report Server versions prior to 2024 Q3 (10.2.24.806), an HTTP DoS attack is possible on anonymous endpoints without rate limiting.
CVSS Score: 7.5 (HIGH)
CWE: CWE-400
References: https://docs.telerik.com/report-server/knowledge-base/uncontrolled-resource-consumption-cve-2024-7294
CVE: CVE-2024-7840
Published: 2024-10-09
Description: In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a command injection attack is possible through improper neutralization of hyperlink elements.
CVSS Score: 7.8 (HIGH)
CWE: CWE-77
References: https://docs.telerik.com/reporting/knowledge-base/command-injection-cve-2024-7840; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-8014
Published: 2024-10-09
Description: In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible through object injection via an insecure type resolution vulnerability.
CVSS Score: 8.8 (HIGH)
CWE: CWE-470, CWE-470
References: https://docs.telerik.com/reporting/knowledge-base/insecure-type-resolution-cve-2024-8014; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-8015
Published: 2024-10-09
Description: In Progress Telerik Report Server versions prior to 2024 Q3 (10.2.24.924), a remote code execution attack is possible through object injection via an insecure type resolution vulnerability.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-470
References: https://docs.telerik.com/report-server/knowledge-base/insecure-type-resolution-cve-2024-8015
CVE: CVE-2024-8048
Published: 2024-10-09
Description: In Progress Telerik Reporting versions prior to 2024 Q3 (18.2.24.924), a code execution attack is possible using object injection via insecure expression evaluation.
CVSS Score: 7.8 (HIGH)
CWE: CWE-470
References: https://docs.telerik.com/reporting/knowledge-base/insecure-expression-evaluation-cve-2024-8048; https://security.netapp.com/advisory/ntap-20[PII_REDACTED]/
CVE: CVE-2024-9671
Published: 2024-10-09
Description: A vulnerability was found in 3Scale. There is no auth mechanism to see a PDF invoice of a Developer user if the URL is known. Anyone can see the invoice if the URL is known or guessed.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-862, CWE-862
References: https://access.redhat.com/security/cve/CVE-2024-9671; https://bugzilla.redhat.com/show_bug.cgi?id=2317449
CVE: CVE-2024-9675
Published: 2024-10-09
Description: A vulnerability was found in Buildah. Cache mounts do not properly validate that user-specified paths for the cache are within our cache directory, allowing a `RUN` instruction in a Container file to mount an arbitrary directory from the host (read/write) into the container as long as those files can be accessed by the user running Buildah.
CVSS Score: 7.8 (HIGH)
CWE: CWE-22, CWE-22
References: https://access.redhat.com/errata/RHSA-2024:8563; https://access.redhat.com/errata/RHSA-2024:8675; https://access.redhat.com/errata/RHSA-2024:8679
CVE: CVE-2024-25825
Published: 2024-10-09
Description: FydeOS for PC 17.1 R114, FydeOS for VMware 17.0 R114, FydeOS for You 17.1 R114, and OpenFyde R114 were discovered to be configured with the root password saved as a wildcard. This allows attackers to gain root access without a password.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-259
References: https://fydeos.io/; https://gist.github.com/hchasens/d20dff418f6908dc96e65f4e43a058f1; https://github.com/openFyde/
CVE: CVE-2024-46292
Published: 2024-10-09
Description: A buffer overflow in modsecurity v3.0.12 allows attackers to cause a Denial of Service (DoS) via a crafted input inserted into the name parameter. NOTE: this is disputed by the Supplier because it cannot be reproduced. Also, the product's documentation indicates that it is not guaranteed to be usable with very large values of SecRequestBodyNoFilesLimit (which are required by the claimed issue).
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/owasp-modsecurity/ModSecurity/blob/v3/master/README.md; https://github.com/yoloflz101/yoloflz/blob/main/README.md; https://modsecurity.org/20241011/about-cve-2024-46292-2024-october/
CVE: CVE-2024-46304
Published: 2024-10-09
Description: A NULL pointer dereference in libcoap v4.3.5-rc2 and below allows a remote attacker to cause a denial of service via the coap_handle_request_put_block function in src/coap_block.c.
CVSS Score: 7.5 (HIGH)
CWE: CWE-120
References: https://github.com/obgm/libcoap/issues/1509
CVE: CVE-2024-46316
Published: 2024-10-09
Description: DrayTek Vigor3900 v1.5.1.6 was discovered to contain a command injection vulnerability via the sub_2C920 function at /cgi-bin/mainfunction.cgi. This vulnerability allows attackers to execute arbitrary commands via supplying a crafted HTTP message.
CVSS Score: 8.0 (HIGH)
CWE: CWE-78
References: https://github.com/glkfc/IoT-Vulnerability/blob/main/DaryTek/vigor3900_4.md
CVE: CVE-2024-42988
Published: 2024-10-09
Description: Lack of access control in ChallengeSolves (/api/v1/challenges/<challenge id>/solves) of CTFd v2.0.0 - v3.7.2 allows authenticated users to retrieve a list of users who have solved the challenge, regardless of the Account Visibility settings. The issue is fixed in v3.7.3+.
CVSS Score: 4.3 (MEDIUM)
CWE: CWE-284
References: https://blog.ctfd.io/ctfd-3-7-3/; https://github.com/CTFd/CTFd/pull/2570; https://github.com/CTFd/CTFd/releases/tag/3.7.3
CVE: CVE-2024-43610
Published: 2024-10-09
Description: Exposure of Sensitive Information to an Unauthorized Actor in Copilot Studio allows a unauthenticated attacker to view sensitive information through network attack vector
CVSS Score: 7.4 (HIGH)
CWE: CWE-200
References: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43610
CVE: CVE-2024-45746
Published: 2024-10-09
Description: An issue was discovered in Trusted Firmware-M through 2.1.0. User provided (and controlled) mailbox messages contain a pointer to a list of input arguments (in_vec) and output arguments (out_vec). These list pointers are never validated. Each argument list contains a buffer pointer and a buffer length field. After a PSA call, the length of the output arguments behind the unchecked pointer is updated in mailbox_direct_reply, regardless of the call result. This allows an attacker to write anywhere in the secure firmware, which can be used to take over the control flow, leading to remote code execution (RCE).
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-120
References: https://trustedfirmware-m.readthedocs.io/en/latest/security/security_advisories/user_pointers_mailbox_vectors_vulnerability.html; https://www.trustedfirmware.org/projects/tf-m/
CVE: CVE-2024-46307
Published: 2024-10-09
Description: A loop hole in the payment logic of Sparkshop v1.16 allows attackers to arbitrarily modify the number of products.
CVSS Score: 7.5 (HIGH)
CWE: CWE-841
References: http://sparkshop.com; https://gitee.com/sparkshop/sparkshop; https://github.com/Yllxx03/CVE/tree/main/CVE-2024-46307
CVE: CVE-2024-9463
Published: 2024-10-09
Description: An OS command injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
CVSS Score: 7.5 (HIGH)
CWE: CWE-78, CWE-78
References: https://security.paloaltonetworks.com/PAN-SA-2024-0010; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9463
CVE: CVE-2024-9464
Published: 2024-10-09
Description: An OS command injection vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to run arbitrary OS commands as root in Expedition, resulting in disclosure of usernames, cleartext passwords, device configurations, and device API keys of PAN-OS firewalls.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-78, CWE-78
References: https://security.paloaltonetworks.com/PAN-SA-2024-0010; https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/
CVE: CVE-2024-9465
Published: 2024-10-09
Description: An SQL injection vulnerability in Palo Alto Networks Expedition allows an unauthenticated attacker to reveal Expedition database contents, such as password hashes, usernames, device configurations, and device API keys. With this, attackers can also create and read arbitrary files on the Expedition system.
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-89, CWE-89
References: https://security.paloaltonetworks.com/PAN-SA-2024-0010; https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/; https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-9465
CVE: CVE-2024-9466
Published: 2024-10-09
Description: A cleartext storage of sensitive information vulnerability in Palo Alto Networks Expedition allows an authenticated attacker to reveal firewall usernames, passwords, and API keys generated using those credentials.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-532, CWE-312
References: https://security.paloaltonetworks.com/PAN-SA-2024-0010; https://www.horizon3.ai/attack-research/palo-alto-expedition-from-n-day-to-full-compromise/
CVE: CVE-2024-9467
Published: 2024-10-09
Description: A reflected XSS vulnerability in Palo Alto Networks Expedition enables execution of malicious JavaScript in the context of an authenticated Expedition user's browser if that user clicks on a malicious link, allowing phishing attacks that could lead to Expedition browser session theft.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://security.paloaltonetworks.com/PAN-SA-2024-0010
CVE: CVE-2024-9468
Published: 2024-10-09
Description: A memory corruption vulnerability in Palo Alto Networks PAN-OS software allows an unauthenticated attacker to crash PAN-OS due to a crafted packet through the data plane, resulting in a denial of service (DoS) condition. Repeated attempts to trigger this condition will result in PAN-OS entering maintenance mode.
CVSS Score: 7.5 (HIGH)
CWE: CWE-787
References: https://security.paloaltonetworks.com/CVE-2024-9468
CVE: CVE-2024-9469
Published: 2024-10-09
Description: A problem with a detection mechanism in the Palo Alto Networks Cortex XDR agent on Windows devices enables a user with Windows non-administrative privileges to disable the agent. This issue may be leveraged by malware to disable the Cortex XDR agent and then to perform malicious activity.
CVSS Score: 5.5 (MEDIUM)
CWE: CWE-754, CWE-754
References: https://security.paloaltonetworks.com/CVE-2024-9469
CVE: CVE-2024-9470
Published: 2024-10-09
Description: A vulnerability in Cortex XSOAR allows the disclosure of incident data to users who do not have the privilege to view the data.
CWE: CWE-497
References: https://security.paloaltonetworks.com/CVE-2024-9470
CVE: CVE-2024-9471
Published: 2024-10-09
Description: A privilege escalation (PE) vulnerability in the XML API of Palo Alto Networks PAN-OS software enables an authenticated PAN-OS administrator with restricted privileges to use a compromised XML API key to perform actions as a higher privileged PAN-OS administrator. For example, an administrator with "Virtual system administrator (read-only)" access could use an XML API key of a "Virtual system administrator" to perform write operations on the virtual system configuration even though they should be limited to read-only operations.
CVSS Score: 4.7 (MEDIUM)
CWE: CWE-269
References: https://security.paloaltonetworks.com/CVE-2024-9471
CVE: CVE-2024-9473
Published: 2024-10-09
Description: A privilege escalation vulnerability in the Palo Alto Networks GlobalProtect app on Windows allows a locally authenticated non-administrative Windows user to escalate their privileges to NT AUTHORITY/SYSTEM through the use of the repair functionality offered by the .msi file used to install GlobalProtect.
CVSS Score: 7.8 (HIGH)
CWE: CWE-250
References: https://sec-consult.com/vulnerability-lab/advisory/local-privilege-escalation-via-msi-installer-in-palo-alto-networks-globalprotect/; https://security.paloaltonetworks.com/CVE-2024-9473; http://seclists.org/fulldisclosure/2024/Oct/2
CVE: CVE-2024-3656
Published: 2024-10-09
Description: A flaw was found in Keycloak. Certain endpoints in Keycloak's admin REST API allow low-privilege users to access administrative functionalities. This flaw allows users to perform actions reserved for administrators, potentially leading to data breaches or system compromise.
CVSS Score: 8.1 (HIGH)
CWE: CWE-200
References: https://access.redhat.com/errata/RHSA-2024:3572; https://access.redhat.com/errata/RHSA-2024:3575; https://access.redhat.com/security/cve/CVE-2024-3656
CVE: CVE-2024-47812
Published: 2024-10-09
Description: ImportDump is an extension for mediawiki designed to automate user import requests. Anyone who can edit the interface strings of a wiki (typically administrators and interface admins) can embed XSS payloads in the messages for dates, and thus XSS anyone who views Special:RequestImportQueue. This issue has been patched in commit `d054b95` and all users are advised to apply this commit to their branch. Users unable to upgrade may either Prevent access to Special:RequestImportQueue on all wikis, except for the global wiki; and If an interface administrator (or equivalent) level protection is available (which is not provided by default) on the global wiki, protect the affected messages up to that level. This causes the XSS to be virtually useless as users with those rights can already edit Javascript pages. Or Prevent access to Special:RequestImportQueue altogether.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-79, CWE-80
References: https://github.com/miraheze/ImportDump/commit/d054b9529129af79d4426df24faa80014cb16602; https://github.com/miraheze/ImportDump/security/advisories/GHSA-465h-45v4-6fx9; https://issue-tracker.miraheze.org/T12698
CVE: CVE-2024-47815
Published: 2024-10-09
Description: IncidentReporting is a MediaWiki extension for moving incident reports from wikitext to database tables. There are a variety of Cross-site Scripting issues, though all of them require elevated permissions. Some are available to anyone who has the `editincidents` right, some are available to those who can edit interface messages (typically administrators and interface admins), and one is available to those who can edit LocalSettings.php. These issues have been addressed in commit `43896a4` and all users are advised to upgrade. Users unable to upgrade should prevent access to the Special:IncidentReports page.
CVSS Score: 6.0 (MEDIUM)
CWE: CWE-79, CWE-80
References: https://github.com/miraheze/IncidentReporting/commit/43896a47de4e05ac94ec0472c220da944da16c5c; https://github.com/miraheze/IncidentReporting/security/advisories/GHSA-9p36-hrmr-98r9; https://issue-tracker.miraheze.org/T12702
CVE: CVE-2024-47816
Published: 2024-10-09
Description: ImportDump is a mediawiki extension designed to automate user import requests. A user's local actor ID is stored in the database to tell who made what requests. Therefore, if a user on another wiki happens to have the same actor ID as someone on the central wiki, the user on the other wiki can act as if they're the original wiki requester. This can be abused to create new comments, edit the request, and view the request if it's marked private. This issue has been addressed in commit `5c91dfc` and all users are advised to update. Users unable to update may disable the special page outside of their global wiki. See `miraheze/mw-config@e566499` for details on that.
CVSS Score: 6.4 (MEDIUM)
CWE: CWE-282
References: https://github.com/miraheze/ImportDump/commit/5c91dfce78320e717516ee65ef5a05f01979ee6c; https://github.com/miraheze/ImportDump/security/advisories/GHSA-jjmq-mg36-6387; https://github.com/miraheze/mw-config/commit/e5664995fbb8644f9a80b450b4326194f20f9ddc