CVE-2024-29898: Oversight in fix for GHSA-4rcf-3cj2-46mq may have exposed suppressed wiki requests on private wikis
CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. An oversight during the writing of the patch for CVE-2024-29897 may have exposed suppressed wiki requests to private wikis that added Special:RequestWikiQueue to the read whitelist to users without the (read) permission. This vulnerability is fixed in 8f8442ed5299510ea3e58416004b9334134c149c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
CreateWikito a version that resolves this vulnerability.Patch 8f8442ed5299510ea3e58416004b9334134c149c
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29898?
CVE-2024-29898 is considered to have a moderate severity level due to the potential exposure of private wiki requests.
How do I fix CVE-2024-29898?
To fix CVE-2024-29898, update your Miraheze CreateWiki extension to the latest version that resolves this vulnerability.
What is the impact of CVE-2024-29898 on user privacy?
CVE-2024-29898 may compromise user privacy by allowing unauthorized access to suppressed wiki requests in private wikis.
What versions of CreateWiki are affected by CVE-2024-29898?
CVE-2024-29898 affects versions of Miraheze CreateWiki up to, but not including, version 8f8442ed5299510ea3e58416004b9334134c149c.
Is my data safe if I am using an affected version of CreateWiki with CVE-2024-29898?
If you are using an affected version of CreateWiki, your data may not be safe due to the vulnerability allowing exposure of private information.