CVE-2024-29883: medium-severity vulnerability in miraheze CreateWiki
CreateWiki's wiki request suppression ignores the suppression settings set by the suppressor
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
13Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 4.9epss 0.6%
CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Suppression of wiki requests does not work as intended, and always restricts visibility to those with the `(createwiki)` user right regardless of the settings one sets on a given wiki request. This may expose information to users who are not supposed to be able to access it.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N
Affected products
miraheze · CreateWikiRelated CVEs — miraheze CreateWiki
In the same product, most dangerous first.
CVE-2022-24813MEDIUMAuthentication Bypass Using an Alternate Path or Channel in CreateWikiEPSS 1.0%CVE-2024-29897MEDIUMCreateWiki Leak of suppressed wiki requests outside of `CreateWikiGlobalWiki`EPSS 0.7%CVE-2024-29898MEDIUMOversight in fix for GHSA-4rcf-3cj2-46mq may have exposed suppressed wiki requests on private wikisEPSS 0.7%CVE-2024-34701MEDIUMCreateWiki vulnerable to impersonation of wiki requesterEPSS 0.6%CVE-2024-47781MEDIUMCross-site Scripting (XSS) in Special:RequestWikiQueue when displaying sitename in CreateWikiEPSS 0.3%