CVE-2024-47536

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-47536
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-47536.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2024-47536
Aliases
Published
2024-09-30T17:09:40.192Z
Modified
2026-03-14T12:40:22.303734Z
Severity
  • 4.8 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N CVSS Calculator
Summary
starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field
Details

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. This vulnerability is fixed in 2.31.0.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-79",
        "CWE-80"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47536.json"
}
References

Affected packages

Git / github.com/StarCitizenTools/mediawiki-skins-Citizen

Affected ranges

Type
GIT
Repo
https://github.com/StarCitizenTools/mediawiki-skins-Citizen
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
d4e65977b505bb3915969805cdd5c004325f5e70
Database specific 
{
    "versions": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.31.0"
        }
    ]
}
Type
GIT
Repo
https://github.com/starcitizentools/mediawiki-skins-citizen
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
717d16af35b10dab04d434aefddbf991fc8c168c
Fixed
86da3e07718c8d8da6f4310386fef85599606f9b

Affected versions

v1.*
v1.10.0
v1.13.0
v1.14.0
v1.14.1
v1.15.0
v1.16.0
v1.16.1
v1.17.0
v1.17.1
v1.17.2
v1.17.3
v1.17.4
v1.17.5
v1.17.6
v1.17.7
v1.17.8
v1.17.9
v1.9.4
v1.9.5
v2.*
v2.0.0
v2.0.0-alpha.0
v2.0.0-alpha.1
v2.0.0-alpha.2
v2.0.0-beta.0
v2.0.0-beta.1
v2.0.0-beta.2
v2.0.0-beta.3
v2.0.0-beta.4
v2.0.1
v2.1.0
v2.10.0
v2.10.1
v2.11.0
v2.11.1
v2.12.0
v2.13.0
v2.13.1
v2.13.2
v2.13.3
v2.13.4
v2.13.5
v2.14.0
v2.14.1
v2.15.0
v2.15.1
v2.16.0
v2.16.1
v2.17.0
v2.17.1
v2.17.2
v2.18.0
v2.18.1
v2.19.0
v2.2.0
v2.20.0
v2.21.0
v2.22.0
v2.22.1
v2.23.0
v2.24.0
v2.25.0
v2.26.0
v2.27.0
v2.28.0
v2.29.0
v2.3.0
v2.3.1
v2.3.2
v2.3.3
v2.3.4
v2.3.5
v2.3.6
v2.30.0
v2.4.0
v2.4.1
v2.4.2
v2.4.3
v2.4.4
v2.5.0
v2.5.1
v2.5.2
v2.6.0
v2.6.1
v2.6.2
v2.6.3
v2.6.4
v2.6.5
v2.6.6
v2.7.0
v2.7.1
v2.7.10
v2.7.11
v2.7.2
v2.7.3
v2.7.4
v2.7.5
v2.7.6
v2.7.7
v2.7.8
v2.7.9
v2.8.0
v2.8.1
v2.8.2
v2.8.3
v2.8.4
v2.8.5
v2.9.0
v2.9.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-47536.json"