CVE-2024-47816

MediumCVSS 6.4/10Last modified Jun 17, 2026

Description

ImportDump is a mediawiki extension designed to automate user import requests. A user's local actor ID is stored in the database to tell who made what requests. Therefore, if a user on another wiki happens to have the same actor ID as someone on the central wiki, the user on the other wiki can act as if they're the original wiki requester. This can be abused to create new comments, edit the request, and view the request if it's marked private. This issue has been addressed in commit `5c91dfc` and all users are advised to update. Users unable to update may disable the special page outside of their global wiki. See `miraheze/mw-config@e566499` for details on that.

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:H/A:L

Weakness enumeration

CWE-282

Affected software

No affected versions have been published.

Timeline

Published: Oct 9, 2024
Last modified: Jun 17, 2026
NVD status: Deferred

Related CVEs from 2024

CVE-2024-478176.1Lara-zeus Dynamic Dashboard simple way to manage widgets for your website landing page, and filament dashboard and Lara-zeus artemis is a co CVE-2024-478186.5Saltcorn is an extensible, open source, no-code database application builder. A logged-in user with any role can delete arbitrary files on t CVE-2024-478198.7Umbraco, a free and open source .NET content management system, has a cross-site scripting vulnerability starting in version 14.0.0 and prio CVE-2024-47826.5A denial-of-service vulnerability was reported in some Lenovo printers that could allow an unauthenticated attacker on a shared network to d CVE-2024-478203.5MarkUs, a web application for the submission and grading of student assignments, is vulnerable to path traversal in versions prior to 2.4.8.CVE-2024-478212.3pyLoad is a free and open-source Download Manager. The folder `/.pyload/scripts` has scripts which are run when certain actions are complete CVE-2024-478224.2Directus is a real-time API and App dashboard for managing SQL database content. Access tokens from query strings are not redacted and are p CVE-2024-478239.8Livewire is a full-stack framework for Laravel that allows for dynamic UI components without leaving PHP. In livewire/livewire prior to `2.1 CVE-2024-478248.7matrix-react-sdk is react-based software development kit for inserting a Matrix chat/VOIP client into a web page. Starting in version 3.18.0 CVE-2024-478258.7Cilium is a networking, observability, and security solution with an eBPF-based dataplane. Starting in version 1.14.0 and prior to versions CVE-2024-478266.1eLabFTW is an open source electronic lab notebook for research labs. A vulnerability in versions prior to 5.1.5 allows an attacker to inject CVE-2024-478274.8Argo Workflows is an open source container-native workflow engine for orchestrating parallel jobs on Kubernetes. Due to a race condition in