CVE-2024-47782: Cross-site Scripting (XSS) in Special:WikiDiscover when displaying wiki information in WikiDiscover
WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. Special:WikiDiscover is a special page that lists all wikis on the wiki farm. However, the special page does not make any effort to escape the wiki name or description. Therefore, if a wiki sets its name and/or description to an XSS payload, the XSS will execute whenever the wiki is shown on Special:WikiDiscover. This issue has been patched with commit 2ce846dd93 and all users are advised to apply that patch. User unable to upgrade should block access to Special:WikiDiscover.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-47782?
CVE-2024-47782 is classified as a moderate severity vulnerability due to its potential for impacting the display and interaction with wiki content.
How do I fix CVE-2024-47782?
To fix CVE-2024-47782, ensure that the WikiDiscover extension is updated to a version released after October 6, 2024, that addresses this vulnerability.
What type of vulnerability is CVE-2024-47782?
CVE-2024-47782 is an XSS (Cross-Site Scripting) vulnerability resulting from improper escaping of wiki names and descriptions in the WikiDiscover extension.
Who is affected by CVE-2024-47782?
CVE-2024-47782 affects installations of the Miraheze WikiDiscover extension prior to version 2024-10-06.
What can an attacker do with CVE-2024-47782?
An attacker exploiting CVE-2024-47782 could execute arbitrary JavaScript in a user's browser via crafted wiki names or descriptions.