CVE-2024-29898: Oversight in fix for GHSA-4rcf-3cj2-46mq may have exposed suppressed wiki requests on private wikis
CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. An oversight during the writing of the patch for CVE-2024-29897 may have exposed suppressed wiki requests to private wikis that added Special:RequestWikiQueue to the read whitelist to users without the (read) permission. This vulnerability is fixed in 8f8442ed5299510ea3e58416004b9334134c149c.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-29898?
CVE-2024-29898 is considered to have a moderate severity level due to the potential exposure of private wiki requests.
How do I fix CVE-2024-29898?
To fix CVE-2024-29898, update your Miraheze CreateWiki extension to the latest version that resolves this vulnerability.
What is the impact of CVE-2024-29898 on user privacy?
CVE-2024-29898 may compromise user privacy by allowing unauthorized access to suppressed wiki requests in private wikis.
What versions of CreateWiki are affected by CVE-2024-29898?
CVE-2024-29898 affects versions of Miraheze CreateWiki up to, but not including, version 8f8442ed5299510ea3e58416004b9334134c149c.
Is my data safe if I am using an affected version of CreateWiki with CVE-2024-29898?
If you are using an affected version of CreateWiki, your data may not be safe due to the vulnerability allowing exposure of private information.