CVE-2024-29897: CreateWiki Leak of suppressed wiki requests outside of `CreateWikiGlobalWiki`
CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users with (delete) or (suppressrevision) on any wiki in the farm to access suppressed wiki requests by going to the request's entry on Special:RequestWikiQueue on the wiki where they have these rights. The same vulnerability was present briefly on the REST API before being quickly corrected in commit 6bc0685. To our knowledge, the vulnerable commits of the REST API are not running in production anywhere. This vulnerability is fixed in 23415c17ffb4832667c06abcf1eadadefd4c8937.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29897?
CVE-2024-29897 has been classified as a high-severity vulnerability due to unauthorized access to suppressed wiki requests.
How do I fix CVE-2024-29897?
To fix CVE-2024-29897, ensure that access controls are appropriately configured for users with (delete) or (suppressrevision) permissions.
What impact does CVE-2024-29897 have on MediaWiki?
CVE-2024-29897 allows users with specific permissions to view suppressed wiki requests, potentially compromising user privacy.
Who is affected by CVE-2024-29897?
Any users with (delete) or (suppressrevision) permissions on a Miraheze mediawiki are affected by CVE-2024-29897.
What versions of Miraheze MediaWiki CreateWiki are impacted by CVE-2024-29897?
CVE-2024-29897 affects all versions of the MediaWiki CreateWiki extension in Miraheze if the described permission settings are in place.