CVE-2024-47782

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2024-47782

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-47782.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2024-47782

Aliases

GHSA-wf48-rqx3-39mf

Published

2024-10-07T21:28:01.299Z

Modified

2026-07-15T01:49:15.471736702Z

Severity

7.6 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L CVSS Calculator

Summary

Cross-site Scripting (XSS) in Special:WikiDiscover when displaying wiki information in WikiDiscover

Details

WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. Special:WikiDiscover is a special page that lists all wikis on the wiki farm. However, the special page does not make any effort to escape the wiki name or description. Therefore, if a wiki sets its name and/or description to an XSS payload, the XSS will execute whenever the wiki is shown on Special:WikiDiscover. This issue has been patched with commit 2ce846dd93 and all users are advised to apply that patch. User unable to upgrade should block access to Special:WikiDiscover.

Database specific

{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/47xxx/CVE-2024-47782.json",
    "cwe_ids": [
        "CWE-79",
        "CWE-80"
    ],
    "cna_assigner": "GitHub_M"
}

References

Affected packages

Git / github.com/miraheze/wikidiscover

Affected ranges

Type

GIT

Repo

https://github.com/miraheze/wikidiscover

Events

Introduced

Fixed

2ce846dd93ddb9ec86f7472c4d57fe71a09dc827

Database specific

{
    "source": "REFERENCES"
}

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-47782.json"