CVE-2024-47847 - Vulnerability Details

Vendors	Products
Mediawiki	Cargo
Wikimedia	Mediawiki-cargo

Link	Providers
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063804
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063806
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063827
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063831
https://phabricator.wikimedia.org/T368628
https://phabricator.wikimedia.org/T372211

Type	Values Removed	Values Added
First Time appeared		Mediawiki Mediawiki cargo
CPEs		cpe:2.3:a:mediawiki:cargo:3.6.0:::::::*
Vendors & Products		Mediawiki Mediawiki cargo
Metrics		cvssV3_1 `{'score': 6.1, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N'}`

Type	Values Removed	Values Added
First Time appeared		Wikimedia Wikimedia mediawiki-cargo
CPEs		cpe:2.3:a:wikimedia:mediawiki-cargo::::::::
Vendors & Products		Wikimedia Wikimedia mediawiki-cargo
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.
Title		Various XSSes found in Cargo
Weaknesses		CWE-79
References		https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063804 https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063806 https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063827 https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063831 https://phabricator.wikimedia.org/T368628 https://phabricator.wikimedia.org/T372211
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-47847", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "state": "PUBLISHED", "assignerShortName": "wikimedia-foundation", "dateReserved": "2024-10-03T23:44:16.835Z", "datePublished": "2024-10-05T00:47:24.147Z", "dateUpdated": "2024-10-07T17:18:43.941Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mediawiki - Cargo", "vendor": "The Wikimedia Foundation", "versions": [{"lessThan": "3.6.1", "status": "affected", "version": "3.6.x", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Yaron_Koren"}, {"lang": "en", "type": "finder", "value": "BlankEclair"}], "datePublic": "2024-08-21T00:46:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).<p>This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1."}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2024-10-05T00:47:24.147Z"}, "references": [{"url": "https://phabricator.wikimedia.org/T372211"}, {"url": "https://phabricator.wikimedia.org/T368628"}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063804"}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063806"}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063827"}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063831"}], "source": {"discovery": "UNKNOWN"}, "title": "Various XSSes found in Cargo", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "wikimedia", "product": "mediawiki-cargo", "cpes": ["cpe:2.3:a:wikimedia:mediawiki-cargo:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "3.6.0", "status": "affected", "lessThan": "3.6.1", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-07T17:17:29.194570Z", "id": "CVE-2024-47847", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-07T17:18:43.941Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-47847 (string)

assignerOrgId : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

state : PUBLISHED (string)

assignerShortName : wikimedia-foundation (string)

dateReserved : 2024-10-03T23:44:16.835Z (string)

datePublished : 2024-10-05T00:47:24.147Z (string)

dateUpdated : 2024-10-07T17:18:43.941Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : Mediawiki - Cargo (string)

vendor : The Wikimedia Foundation (string)

versions : [ »

0 : { »

lessThan : 3.6.1 (string)

status : affected (string)

version : 3.6.x (string)

versionType : semver (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Yaron_Koren (string)

}

1 : { »

lang : en (string)

type : finder (string)

value : BlankEclair (string)

}

]

datePublic : 2024-08-21T00:46:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).<p>This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.</p> (string)

}

]

value : Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-63 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-63 Cross-Site Scripting (XSS) (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV4_0 : { »

Automatable : NOT_DEFINED (string)

Recovery : NOT_DEFINED (string)

Safety : NOT_DEFINED (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : NETWORK (string)

baseScore : 6.9 (number)

baseSeverity : MEDIUM (string)

privilegesRequired : NONE (string)

providerUrgency : NOT_DEFINED (string)

subAvailabilityImpact : NONE (string)

subConfidentialityImpact : NONE (string)

subIntegrityImpact : NONE (string)

userInteraction : NONE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N (string)

version : 4.0 (string)

vulnAvailabilityImpact : NONE (string)

vulnConfidentialityImpact : LOW (string)

vulnIntegrityImpact : LOW (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-79 (string)

description : CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

shortName : wikimedia-foundation (string)

dateUpdated : 2024-10-05T00:47:24.147Z (string)

}

references : [ »

0 : { »

url : https://phabricator.wikimedia.org/T372211 (string)

}

1 : { »

url : https://phabricator.wikimedia.org/T368628 (string)

}

2 : { »

url : https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063804 (string)

}

3 : { »

url : https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063806 (string)

}

4 : { »

url : https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063827 (string)

}

5 : { »

url : https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063831 (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : Various XSSes found in Cargo (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : wikimedia (string)

product : mediawiki-cargo (string)

cpes : [ »

0 : cpe:2.3:a:wikimedia:mediawiki-cargo:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unaffected (string)

versions : [ »

0 : { »

version : 3.6.0 (string)

status : affected (string)

lessThan : 3.6.1 (string)

versionType : semver (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-10-07T17:17:29.194570Z (string)

id : CVE-2024-47847 (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-07T17:18:43.941Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47847", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-07T17:17:29.194570Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:wikimedia:mediawiki-cargo:*:*:*:*:*:*:*:*"], "vendor": "wikimedia", "product": "mediawiki-cargo", "versions": [{"status": "affected", "version": "3.6.0", "lessThan": "3.6.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-07T17:18:32.697Z"}}], "cna": {"title": "Various XSSes found in Cargo", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Yaron_Koren"}, {"lang": "en", "type": "finder", "value": "BlankEclair"}], "impacts": [{"capecId": "CAPEC-63", "descriptions": [{"lang": "en", "value": "CAPEC-63 Cross-Site Scripting (XSS)"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "The Wikimedia Foundation", "product": "Mediawiki - Cargo", "versions": [{"status": "affected", "version": "3.6.x", "lessThan": "3.6.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2024-08-21T00:46:00.000Z", "references": [{"url": "https://phabricator.wikimedia.org/T372211"}, {"url": "https://phabricator.wikimedia.org/T368628"}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063804"}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063806"}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063827"}, {"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063831"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).<p>This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2024-10-05T00:47:24.147Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47847", "state": "PUBLISHED", "dateUpdated": "2024-10-07T17:18:43.941Z", "dateReserved": "2024-10-03T23:44:16.835Z", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "datePublished": "2024-10-05T00:47:24.147Z", "assignerShortName": "wikimedia-foundation"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-47847 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-10-07T17:17:29.194570Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:wikimedia:mediawiki-cargo:*:*:*:*:*:*:*:* (string)

]

vendor : wikimedia (string)

product : mediawiki-cargo (string)

versions : [ »

0 : { »

status : affected (string)

version : 3.6.0 (string)

lessThan : 3.6.1 (string)

versionType : semver (string)

}

]

defaultStatus : unaffected (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-07T17:18:32.697Z (string)

}

]

cna : { »

title : Various XSSes found in Cargo (string)

source : { »

discovery : UNKNOWN (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Yaron_Koren (string)

}

1 : { »

lang : en (string)

type : finder (string)

value : BlankEclair (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-63 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-63 Cross-Site Scripting (XSS) (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV4_0 : { »

Safety : NOT_DEFINED (string)

version : 4.0 (string)

Recovery : NOT_DEFINED (string)

baseScore : 6.9 (number)

Automatable : NOT_DEFINED (string)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N (string)

providerUrgency : NOT_DEFINED (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

privilegesRequired : NONE (string)

subIntegrityImpact : NONE (string)

vulnIntegrityImpact : LOW (string)

subAvailabilityImpact : NONE (string)

vulnAvailabilityImpact : NONE (string)

subConfidentialityImpact : NONE (string)

vulnConfidentialityImpact : LOW (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : The Wikimedia Foundation (string)

product : Mediawiki - Cargo (string)

versions : [ »

0 : { »

status : affected (string)

version : 3.6.x (string)

lessThan : 3.6.1 (string)

versionType : semver (string)

}

]

defaultStatus : unaffected (string)

}

]

datePublic : 2024-08-21T00:46:00.000Z (string)

references : [ »

0 : { »

url : https://phabricator.wikimedia.org/T372211 (string)

}

1 : { »

url : https://phabricator.wikimedia.org/T368628 (string)

}

2 : { »

url : https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063804 (string)

}

3 : { »

url : https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063806 (string)

}

4 : { »

url : https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063827 (string)

}

5 : { »

url : https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063831 (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).<p>This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.</p> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-79 (string)

description : CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (string)

}

]

}

]

providerMetadata : { »

orgId : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

shortName : wikimedia-foundation (string)

dateUpdated : 2024-10-05T00:47:24.147Z (string)

}

cveMetadata : { »

cveId : CVE-2024-47847 (string)

state : PUBLISHED (string)

dateUpdated : 2024-10-07T17:18:43.941Z (string)

dateReserved : 2024-10-03T23:44:16.835Z (string)

assignerOrgId : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

datePublished : 2024-10-05T00:47:24.147Z (string)

assignerShortName : wikimedia-foundation (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mediawiki:cargo:3.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "AA92C693-D48A-4C72-85F9-15EF07A113FB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1."}, {"lang": "es", "value": "Vulnerabilidad de neutralizaci\u00f3n incorrecta de la entrada durante la generaci\u00f3n de p\u00e1ginas web (XSS o 'Cross-site Scripting') en The Wikimedia Foundation Mediawiki - Cargo permite Cross-Site Scripting (XSS). Este problema afecta a Mediawiki - Cargo: desde 3.6.X hasta 3.6.1."}], "id": "CVE-2024-47847", "lastModified": "2024-10-16T16:42:05.567", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 6.1, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "NONE", "vulnerableSystemConfidentiality": "LOW", "vulnerableSystemIntegrity": "LOW"}, "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}]}, "published": "2024-10-05T01:15:12.493", "references": [{"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Patch"], "url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063804"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Patch"], "url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063806"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Patch"], "url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063827"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Patch"], "url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063831"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://phabricator.wikimedia.org/T368628"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://phabricator.wikimedia.org/T372211"}], "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:mediawiki:cargo:3.6.0:*:*:*:*:*:*:* (string)

matchCriteriaId : AA92C693-D48A-4C72-85F9-15EF07A113FB (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1. (string)

}

1 : { »

lang : es (string)

value : Vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web (XSS o 'Cross-site Scripting') en The Wikimedia Foundation Mediawiki - Cargo permite Cross-Site Scripting (XSS). Este problema afecta a Mediawiki - Cargo: desde 3.6.X hasta 3.6.1. (string)

}

]

id : CVE-2024-47847 (string)

lastModified : 2024-10-16T16:42:05.567 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 6.1 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : NONE (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 2.8 (number)

impactScore : 2.7 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

cvssMetricV40 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : NETWORK (string)

automatable : NOT_DEFINED (string)

availabilityRequirements : NOT_DEFINED (string)

baseScore : 6.9 (number)

baseSeverity : MEDIUM (string)

confidentialityRequirements : NOT_DEFINED (string)

exploitMaturity : NOT_DEFINED (string)

integrityRequirements : NOT_DEFINED (string)

modifiedAttackComplexity : NOT_DEFINED (string)

modifiedAttackRequirements : NOT_DEFINED (string)

modifiedAttackVector : NOT_DEFINED (string)

modifiedPrivilegesRequired : NOT_DEFINED (string)

modifiedSubsequentSystemAvailability : NOT_DEFINED (string)

modifiedSubsequentSystemConfidentiality : NOT_DEFINED (string)

modifiedSubsequentSystemIntegrity : NOT_DEFINED (string)

modifiedUserInteraction : NOT_DEFINED (string)

modifiedVulnerableSystemAvailability : NOT_DEFINED (string)

modifiedVulnerableSystemConfidentiality : NOT_DEFINED (string)

modifiedVulnerableSystemIntegrity : NOT_DEFINED (string)

privilegesRequired : NONE (string)

providerUrgency : NOT_DEFINED (string)

recovery : NOT_DEFINED (string)

safety : NOT_DEFINED (string)

subsequentSystemAvailability : NONE (string)

subsequentSystemConfidentiality : NONE (string)

subsequentSystemIntegrity : NONE (string)

userInteraction : NONE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (string)

version : 4.0 (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

vulnerableSystemAvailability : NONE (string)

vulnerableSystemConfidentiality : LOW (string)

vulnerableSystemIntegrity : LOW (string)

}

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

type : Secondary (string)

}

]

}

published : 2024-10-05T01:15:12.493 (string)

references : [ »

0 : { »

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

tags : [ »

0 : Patch (string)

]

url : https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063804 (string)

}

1 : { »

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

tags : [ »

0 : Patch (string)

]

url : https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063806 (string)

}

2 : { »

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

tags : [ »

0 : Patch (string)

]

url : https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063827 (string)

}

3 : { »

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

tags : [ »

0 : Patch (string)

]

url : https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1063831 (string)

}

4 : { »

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

tags : [ »

0 : Issue Tracking (string)

1 : Vendor Advisory (string)

]

url : https://phabricator.wikimedia.org/T368628 (string)

}

5 : { »

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

tags : [ »

0 : Exploit (string)

1 : Issue Tracking (string)

2 : Vendor Advisory (string)

]

url : https://phabricator.wikimedia.org/T372211 (string)

}

]

sourceIdentifier : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object