CVE-2024-47849 - Vulnerability Details

Vendors	Products
Mediawiki	Cargo
Wikimedia	Mediawiki-cargo

Link	Providers
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1055963
https://phabricator.wikimedia.org/T368628
https://phabricator.wikimedia.org/T370632

Type	Values Removed	Values Added
First Time appeared		Mediawiki Mediawiki cargo
CPEs		cpe:2.3:a:mediawiki:cargo:3.6.0:::::::*
Vendors & Products		Mediawiki Mediawiki cargo
Metrics		cvssV3_1 `{'score': 9.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H'}`

Type	Values Removed	Values Added
First Time appeared		Wikimedia Wikimedia mediawiki-cargo
CPEs		cpe:2.3:a:wikimedia:mediawiki-cargo::::::::
Vendors & Products		Wikimedia Wikimedia mediawiki-cargo
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Title		Backticks can allow the usage of not-allowed SQL functions

Type	Values Removed	Values Added
Description		Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.
Weaknesses		CWE-89
References		https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1055963 https://phabricator.wikimedia.org/T368628 https://phabricator.wikimedia.org/T370632
Metrics		cvssV4_0 `{'score': 8.8, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-47849", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "state": "PUBLISHED", "assignerShortName": "wikimedia-foundation", "dateReserved": "2024-10-03T23:44:16.836Z", "datePublished": "2024-10-05T00:29:44.438Z", "dateUpdated": "2024-10-07T17:36:40.035Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mediawiki - Cargo", "vendor": "The Wikimedia Foundation", "versions": [{"lessThan": "3.6.1", "status": "affected", "version": "3.6.x", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "Yaron_Koren"}, {"lang": "en", "type": "finder", "value": "BlankEclair"}], "datePublic": "2024-07-23T00:25:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.<p>This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.</p>"}], "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1."}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 8.8, "baseSeverity": "HIGH", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "subIntegrityImpact": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2024-10-05T00:34:12.792Z"}, "references": [{"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1055963"}, {"url": "https://phabricator.wikimedia.org/T370632"}, {"url": "https://phabricator.wikimedia.org/T368628"}], "source": {"discovery": "UNKNOWN"}, "title": "Backticks can allow the usage of not-allowed SQL functions", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "wikimedia", "product": "mediawiki-cargo", "cpes": ["cpe:2.3:a:wikimedia:mediawiki-cargo:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "3.6.0", "status": "affected", "lessThan": "3.6.1", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-07T17:35:58.700370Z", "id": "CVE-2024-47849", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-07T17:36:40.035Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-47849 (string)

assignerOrgId : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

state : PUBLISHED (string)

assignerShortName : wikimedia-foundation (string)

dateReserved : 2024-10-03T23:44:16.836Z (string)

datePublished : 2024-10-05T00:29:44.438Z (string)

dateUpdated : 2024-10-07T17:36:40.035Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : Mediawiki - Cargo (string)

vendor : The Wikimedia Foundation (string)

versions : [ »

0 : { »

lessThan : 3.6.1 (string)

status : affected (string)

version : 3.6.x (string)

versionType : semver (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Yaron_Koren (string)

}

1 : { »

lang : en (string)

type : finder (string)

value : BlankEclair (string)

}

]

datePublic : 2024-07-23T00:25:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.<p>This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.</p> (string)

}

]

value : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-66 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-66 SQL Injection (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV4_0 : { »

Automatable : NOT_DEFINED (string)

Recovery : NOT_DEFINED (string)

Safety : NOT_DEFINED (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : NETWORK (string)

baseScore : 8.8 (number)

baseSeverity : HIGH (string)

privilegesRequired : NONE (string)

providerUrgency : NOT_DEFINED (string)

subAvailabilityImpact : NONE (string)

subConfidentialityImpact : LOW (string)

subIntegrityImpact : LOW (string)

userInteraction : NONE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N (string)

version : 4.0 (string)

vulnAvailabilityImpact : NONE (string)

vulnConfidentialityImpact : HIGH (string)

vulnIntegrityImpact : LOW (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-89 (string)

description : CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

shortName : wikimedia-foundation (string)

dateUpdated : 2024-10-05T00:34:12.792Z (string)

}

references : [ »

0 : { »

url : https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1055963 (string)

}

1 : { »

url : https://phabricator.wikimedia.org/T370632 (string)

}

2 : { »

url : https://phabricator.wikimedia.org/T368628 (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : Backticks can allow the usage of not-allowed SQL functions (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : wikimedia (string)

product : mediawiki-cargo (string)

cpes : [ »

0 : cpe:2.3:a:wikimedia:mediawiki-cargo:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unaffected (string)

versions : [ »

0 : { »

version : 3.6.0 (string)

status : affected (string)

lessThan : 3.6.1 (string)

versionType : semver (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-10-07T17:35:58.700370Z (string)

id : CVE-2024-47849 (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-07T17:36:40.035Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47849", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-07T17:35:58.700370Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:wikimedia:mediawiki-cargo:*:*:*:*:*:*:*:*"], "vendor": "wikimedia", "product": "mediawiki-cargo", "versions": [{"status": "affected", "version": "3.6.0", "lessThan": "3.6.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-07T17:36:35.673Z"}}], "cna": {"title": "Backticks can allow the usage of not-allowed SQL functions", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "Yaron_Koren"}, {"lang": "en", "type": "finder", "value": "BlankEclair"}], "impacts": [{"capecId": "CAPEC-66", "descriptions": [{"lang": "en", "value": "CAPEC-66 SQL Injection"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 8.8, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "HIGH", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "The Wikimedia Foundation", "product": "Mediawiki - Cargo", "versions": [{"status": "affected", "version": "3.6.x", "lessThan": "3.6.1", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2024-07-23T00:25:00.000Z", "references": [{"url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1055963"}, {"url": "https://phabricator.wikimedia.org/T370632"}, {"url": "https://phabricator.wikimedia.org/T368628"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.<p>This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-89", "description": "CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2024-10-05T00:34:12.792Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47849", "state": "PUBLISHED", "dateUpdated": "2024-10-07T17:36:40.035Z", "dateReserved": "2024-10-03T23:44:16.836Z", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "datePublished": "2024-10-05T00:29:44.438Z", "assignerShortName": "wikimedia-foundation"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-47849 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-10-07T17:35:58.700370Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:wikimedia:mediawiki-cargo:*:*:*:*:*:*:*:* (string)

]

vendor : wikimedia (string)

product : mediawiki-cargo (string)

versions : [ »

0 : { »

status : affected (string)

version : 3.6.0 (string)

lessThan : 3.6.1 (string)

versionType : semver (string)

}

]

defaultStatus : unaffected (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-07T17:36:35.673Z (string)

}

]

cna : { »

title : Backticks can allow the usage of not-allowed SQL functions (string)

source : { »

discovery : UNKNOWN (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : Yaron_Koren (string)

}

1 : { »

lang : en (string)

type : finder (string)

value : BlankEclair (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-66 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-66 SQL Injection (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV4_0 : { »

Safety : NOT_DEFINED (string)

version : 4.0 (string)

Recovery : NOT_DEFINED (string)

baseScore : 8.8 (number)

Automatable : NOT_DEFINED (string)

attackVector : NETWORK (string)

baseSeverity : HIGH (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N (string)

providerUrgency : NOT_DEFINED (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

privilegesRequired : NONE (string)

subIntegrityImpact : LOW (string)

vulnIntegrityImpact : LOW (string)

subAvailabilityImpact : NONE (string)

vulnAvailabilityImpact : NONE (string)

subConfidentialityImpact : LOW (string)

vulnConfidentialityImpact : HIGH (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : The Wikimedia Foundation (string)

product : Mediawiki - Cargo (string)

versions : [ »

0 : { »

status : affected (string)

version : 3.6.x (string)

lessThan : 3.6.1 (string)

versionType : semver (string)

}

]

defaultStatus : unaffected (string)

}

]

datePublic : 2024-07-23T00:25:00.000Z (string)

references : [ »

0 : { »

url : https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1055963 (string)

}

1 : { »

url : https://phabricator.wikimedia.org/T370632 (string)

}

2 : { »

url : https://phabricator.wikimedia.org/T368628 (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.<p>This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.</p> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-89 (string)

description : CWE-89 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') (string)

}

]

}

]

providerMetadata : { »

orgId : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

shortName : wikimedia-foundation (string)

dateUpdated : 2024-10-05T00:34:12.792Z (string)

}

cveMetadata : { »

cveId : CVE-2024-47849 (string)

state : PUBLISHED (string)

dateUpdated : 2024-10-07T17:36:40.035Z (string)

dateReserved : 2024-10-03T23:44:16.836Z (string)

assignerOrgId : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

datePublished : 2024-10-05T00:29:44.438Z (string)

assignerShortName : wikimedia-foundation (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:mediawiki:cargo:3.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "AA92C693-D48A-4C72-85F9-15EF07A113FB", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1."}, {"lang": "es", "value": "Vulnerabilidad de neutralizaci\u00f3n incorrecta de elementos especiales utilizados en un comando SQL ('Inyecci\u00f3n SQL') en The Wikimedia Foundation Mediawiki - Cargo permite la inyecci\u00f3n SQL. Este problema afecta a Mediawiki - Cargo: desde 3.6.X hasta 3.6.1."}], "id": "CVE-2024-47849", "lastModified": "2024-10-16T16:34:40.490", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 9.8, "baseSeverity": "CRITICAL", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "LOW", "subsequentSystemIntegrity": "LOW", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "NONE", "vulnerableSystemConfidentiality": "HIGH", "vulnerableSystemIntegrity": "LOW"}, "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}]}, "published": "2024-10-05T01:15:12.610", "references": [{"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Patch"], "url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1055963"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://phabricator.wikimedia.org/T368628"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://phabricator.wikimedia.org/T370632"}], "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-89"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-89"}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:mediawiki:cargo:3.6.0:*:*:*:*:*:*:* (string)

matchCriteriaId : AA92C693-D48A-4C72-85F9-15EF07A113FB (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows SQL Injection.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1. (string)

}

1 : { »

lang : es (string)

value : Vulnerabilidad de neutralización incorrecta de elementos especiales utilizados en un comando SQL ('Inyección SQL') en The Wikimedia Foundation Mediawiki - Cargo permite la inyección SQL. Este problema afecta a Mediawiki - Cargo: desde 3.6.X hasta 3.6.1. (string)

}

]

id : CVE-2024-47849 (string)

lastModified : 2024-10-16T16:34:40.490 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 9.8 (number)

baseSeverity : CRITICAL (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

cvssMetricV40 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : NETWORK (string)

automatable : NOT_DEFINED (string)

availabilityRequirements : NOT_DEFINED (string)

baseScore : 8.8 (number)

baseSeverity : HIGH (string)

confidentialityRequirements : NOT_DEFINED (string)

exploitMaturity : NOT_DEFINED (string)

integrityRequirements : NOT_DEFINED (string)

modifiedAttackComplexity : NOT_DEFINED (string)

modifiedAttackRequirements : NOT_DEFINED (string)

modifiedAttackVector : NOT_DEFINED (string)

modifiedPrivilegesRequired : NOT_DEFINED (string)

modifiedSubsequentSystemAvailability : NOT_DEFINED (string)

modifiedSubsequentSystemConfidentiality : NOT_DEFINED (string)

modifiedSubsequentSystemIntegrity : NOT_DEFINED (string)

modifiedUserInteraction : NOT_DEFINED (string)

modifiedVulnerableSystemAvailability : NOT_DEFINED (string)

modifiedVulnerableSystemConfidentiality : NOT_DEFINED (string)

modifiedVulnerableSystemIntegrity : NOT_DEFINED (string)

privilegesRequired : NONE (string)

providerUrgency : NOT_DEFINED (string)

recovery : NOT_DEFINED (string)

safety : NOT_DEFINED (string)

subsequentSystemAvailability : NONE (string)

subsequentSystemConfidentiality : LOW (string)

subsequentSystemIntegrity : LOW (string)

userInteraction : NONE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (string)

version : 4.0 (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

vulnerableSystemAvailability : NONE (string)

vulnerableSystemConfidentiality : HIGH (string)

vulnerableSystemIntegrity : LOW (string)

}

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

type : Secondary (string)

}

]

}

published : 2024-10-05T01:15:12.610 (string)

references : [ »

0 : { »

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

tags : [ »

0 : Patch (string)

]

url : https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cargo/+/1055963 (string)

}

1 : { »

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

tags : [ »

0 : Issue Tracking (string)

1 : Vendor Advisory (string)

]

url : https://phabricator.wikimedia.org/T368628 (string)

}

2 : { »

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

tags : [ »

0 : Exploit (string)

1 : Issue Tracking (string)

2 : Vendor Advisory (string)

]

url : https://phabricator.wikimedia.org/T370632 (string)

}

]

sourceIdentifier : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-89 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-89 (string)

}

]

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact High

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact Low

Subsequent System Integrity Impact Low

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object