CVE-2024-34502: CSRF
An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attempt to) make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit token.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-34502?
CVE-2024-34502 is classified as a security vulnerability that can lead to unauthorized edits.
How do I fix CVE-2024-34502?
To fix CVE-2024-34502, upgrade MediaWiki to version 1.39.6, 1.40.2, or 1.41.1 or later.
What systems are affected by CVE-2024-34502?
CVE-2024-34502 affects MediaWiki before version 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1.
What kind of attack does CVE-2024-34502 enable?
CVE-2024-34502 enables an attack where unauthorized edits can be made through a GET request rather than a POST request.
Is user interaction required to exploit CVE-2024-34502?
No, user interaction is not required to exploit CVE-2024-34502 as the vulnerability can be triggered indirectly.