CVE-2024-47612

LowCVSS 3.5/10Last modified Jun 17, 2026

Description

DataDump is a MediaWiki extension that provides dumps of wikis. Several interface messages are unescaped (more specifically, (datadump-table-column-queued), (datadump-table-column-in-progress), (datadump-table-column-completed), (datadump-table-column-failed)). If these messages are edited (which requires the (editinterface) right by default), anyone who can view Special:DataDump (which requires the (view-dump) right by default) can be XSSed. This vulnerability is fixed with 601688ee8e8808a23b102fa305b178f27cbd226d.

Metrics

CVSS 3.1 3.5/10CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

Weakness enumeration

CWE-79 CWE-80

Affected software

Vendor	Product	Versions
miraheze	DataDump	< 601688ee8e8808a23b102fa305b178f27cbd226d

References

Timeline

Published: Oct 2, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-476139.8GStreamer is a library for constructing graphs of media-handling components. A null pointer dereference vulnerability has been identified in CVE-2024-476147.5async-graphql is a GraphQL server library implemented in Rust. async-graphql before 7.0.10 does not limit the number of directives for a fie CVE-2024-476159.8GStreamer is a library for constructing graphs of media-handling components. An OOB-Write has been detected in the function gst_parse_vorbis CVE-2024-476166.8Pomerium is an identity and context-aware access proxy. The Pomerium databroker service is responsible for managing all persistent Pomerium CVE-2024-476176.1Sulu is a PHP content management system. This vulnerability allows an attacker to inject arbitrary HTML/JavaScript code through the media do CVE-2024-476185.4Sulu is a PHP content management system. Sulu is vulnerable against XSS whereas a low privileged user with access to the “Media” section can CVE-2024-476197.5syslog-ng is an enhanced log daemo. Prior to version 4.8.2, `tls_wildcard_match()` matches on certificates such as `foo.*.bar` although that CVE-2024-47627.8An improper validation vulnerability was reported in the firmware update mechanism of LADM and LDCC that could allow a local attacker to esc CVE-2024-476216.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Katie Zotpress zotpress allows Stored CVE-2024-476226.5Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in ILLID Advanced Woo Labels advanced-woo CVE-2024-476235.9Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in GhozyLab Gallery Lightbox gallery-ligh CVE-2024-476247.1Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in bannersky BSK Forms Blacklist bsk-grav