CVE-2022-24813: Authentication Bypass Using an Alternate Path or Channel in CreateWiki
CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:RequestWikiQueue when sent directly via POST. A patch for this issue is available in the master branch of CreateWiki's GitHub repository.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-24813?
CVE-2022-24813 is classified as a moderate severity vulnerability allowing anonymous comments through a specific endpoint.
How do I fix CVE-2022-24813?
To resolve CVE-2022-24813, update your Miraheze CreateWiki extension to the latest version beyond the patch available in the master branch.
What systems are affected by CVE-2022-24813?
CVE-2022-24813 affects versions of the Miraheze CreateWiki extension prior to the 2022-04-02 version.
What can be exploited in CVE-2022-24813?
CVE-2022-24813 allows unauthenticated users to post comments via the Special:RequestWikiQueue endpoint.
Is there a workaround for CVE-2022-24813?
Disabling the Special:RequestWikiQueue feature can serve as a temporary workaround until the extension is updated.