CVE-2024-47840 - Vulnerability Details

Vendors	Products
Wikimedia	Apex Mediawiki-apex Skin

Link	Providers
https://gerrit.wikimedia.org/r/q/Id9093783051c3f8e6dcb5dc89f9493a5f5cf7bd7
https://phabricator.wikimedia.org/T368628
https://phabricator.wikimedia.org/T370081

Type	Values Removed	Values Added
First Time appeared		Wikimedia apex
CPEs		cpe:2.3:a:wikimedia:apex::::::::
Vendors & Products		Wikimedia apex
Metrics		cvssV3_1 `{'score': 4.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N'}`

Type	Values Removed	Values Added
First Time appeared		Wikimedia Wikimedia mediawiki-apex Skin
CPEs		cpe:2.3:a:wikimedia:mediawiki-apex_skin::::::::
Vendors & Products		Wikimedia Wikimedia mediawiki-apex Skin
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.This issue affects Mediawiki - Apex skin: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.
Title		Stored XSS through sidebar in Apex skin
Weaknesses		CWE-79
References		https://gerrit.wikimedia.org/r/q/Id9093783051c3f8e6dcb5dc89f9493a5f5cf7bd7 https://phabricator.wikimedia.org/T368628 https://phabricator.wikimedia.org/T370081
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-47840", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "state": "PUBLISHED", "assignerShortName": "wikimedia-foundation", "dateReserved": "2024-10-03T23:44:16.834Z", "datePublished": "2024-10-05T00:53:38.813Z", "dateUpdated": "2024-10-07T17:15:49.923Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mediawiki - Apex skin", "vendor": "The Wikimedia Foundation", "versions": [{"lessThan": "1.39.9", "status": "affected", "version": "1.39.x", "versionType": "semver"}, {"lessThan": "1.41.3", "status": "affected", "version": "1.41.x", "versionType": "semver"}, {"lessThan": "1.42.2", "status": "affected", "version": "1.42.x", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "R4356th"}], "datePublic": "2024-10-05T00:49:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.<p>This issue affects Mediawiki - Apex skin: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.</p>"}], "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.This issue affects Mediawiki - Apex skin: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2."}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2024-10-05T00:53:38.813Z"}, "references": [{"url": "https://phabricator.wikimedia.org/T368628"}, {"url": "https://phabricator.wikimedia.org/T370081"}, {"url": "https://gerrit.wikimedia.org/r/q/Id9093783051c3f8e6dcb5dc89f9493a5f5cf7bd7"}], "source": {"discovery": "UNKNOWN"}, "title": "Stored XSS through sidebar in Apex skin", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "wikimedia", "product": "mediawiki-apex_skin", "cpes": ["cpe:2.3:a:wikimedia:mediawiki-apex_skin:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "1.39.0", "status": "affected", "lessThan": "1.39.9", "versionType": "semver"}, {"version": "1.41.0", "status": "affected", "lessThan": "1.41.3", "versionType": "semver"}, {"version": "1.42.0", "status": "affected", "lessThan": "1.42.2", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-07T17:12:20.750807Z", "id": "CVE-2024-47840", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-07T17:15:49.923Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-47840 (string)

assignerOrgId : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

state : PUBLISHED (string)

assignerShortName : wikimedia-foundation (string)

dateReserved : 2024-10-03T23:44:16.834Z (string)

datePublished : 2024-10-05T00:53:38.813Z (string)

dateUpdated : 2024-10-07T17:15:49.923Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : Mediawiki - Apex skin (string)

vendor : The Wikimedia Foundation (string)

versions : [ »

0 : { »

lessThan : 1.39.9 (string)

status : affected (string)

version : 1.39.x (string)

versionType : semver (string)

}

1 : { »

lessThan : 1.41.3 (string)

status : affected (string)

version : 1.41.x (string)

versionType : semver (string)

}

2 : { »

lessThan : 1.42.2 (string)

status : affected (string)

version : 1.42.x (string)

versionType : semver (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : R4356th (string)

}

]

datePublic : 2024-10-05T00:49:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.<p>This issue affects Mediawiki - Apex skin: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.</p> (string)

}

]

value : Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.This issue affects Mediawiki - Apex skin: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-592 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-592 Stored XSS (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV4_0 : { »

Automatable : NOT_DEFINED (string)

Recovery : NOT_DEFINED (string)

Safety : NOT_DEFINED (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : NETWORK (string)

baseScore : 6.9 (number)

baseSeverity : MEDIUM (string)

privilegesRequired : NONE (string)

providerUrgency : NOT_DEFINED (string)

subAvailabilityImpact : NONE (string)

subConfidentialityImpact : NONE (string)

subIntegrityImpact : NONE (string)

userInteraction : NONE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N (string)

version : 4.0 (string)

vulnAvailabilityImpact : NONE (string)

vulnConfidentialityImpact : LOW (string)

vulnIntegrityImpact : LOW (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-79 (string)

description : CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

shortName : wikimedia-foundation (string)

dateUpdated : 2024-10-05T00:53:38.813Z (string)

}

references : [ »

0 : { »

url : https://phabricator.wikimedia.org/T368628 (string)

}

1 : { »

url : https://phabricator.wikimedia.org/T370081 (string)

}

2 : { »

url : https://gerrit.wikimedia.org/r/q/Id9093783051c3f8e6dcb5dc89f9493a5f5cf7bd7 (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : Stored XSS through sidebar in Apex skin (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : wikimedia (string)

product : mediawiki-apex_skin (string)

cpes : [ »

0 : cpe:2.3:a:wikimedia:mediawiki-apex_skin:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unaffected (string)

versions : [ »

0 : { »

version : 1.39.0 (string)

status : affected (string)

lessThan : 1.39.9 (string)

versionType : semver (string)

}

1 : { »

version : 1.41.0 (string)

status : affected (string)

lessThan : 1.41.3 (string)

versionType : semver (string)

}

2 : { »

version : 1.42.0 (string)

status : affected (string)

lessThan : 1.42.2 (string)

versionType : semver (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-10-07T17:12:20.750807Z (string)

id : CVE-2024-47840 (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-07T17:15:49.923Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47840", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-07T17:12:20.750807Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:wikimedia:mediawiki-apex_skin:*:*:*:*:*:*:*:*"], "vendor": "wikimedia", "product": "mediawiki-apex_skin", "versions": [{"status": "affected", "version": "1.39.0", "lessThan": "1.39.9", "versionType": "semver"}, {"status": "affected", "version": "1.41.0", "lessThan": "1.41.3", "versionType": "semver"}, {"status": "affected", "version": "1.42.0", "lessThan": "1.42.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-07T17:15:42.340Z"}}], "cna": {"title": "Stored XSS through sidebar in Apex skin", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "R4356th"}], "impacts": [{"capecId": "CAPEC-592", "descriptions": [{"lang": "en", "value": "CAPEC-592 Stored XSS"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "The Wikimedia Foundation", "product": "Mediawiki - Apex skin", "versions": [{"status": "affected", "version": "1.39.x", "lessThan": "1.39.9", "versionType": "semver"}, {"status": "affected", "version": "1.41.x", "lessThan": "1.41.3", "versionType": "semver"}, {"status": "affected", "version": "1.42.x", "lessThan": "1.42.2", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2024-10-05T00:49:00.000Z", "references": [{"url": "https://phabricator.wikimedia.org/T368628"}, {"url": "https://phabricator.wikimedia.org/T370081"}, {"url": "https://gerrit.wikimedia.org/r/q/Id9093783051c3f8e6dcb5dc89f9493a5f5cf7bd7"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.This issue affects Mediawiki - Apex skin: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.", "supportingMedia": [{"type": "text/html", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.<p>This issue affects Mediawiki - Apex skin: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-79", "description": "CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2024-10-05T00:53:38.813Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47840", "state": "PUBLISHED", "dateUpdated": "2024-10-07T17:15:49.923Z", "dateReserved": "2024-10-03T23:44:16.834Z", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "datePublished": "2024-10-05T00:53:38.813Z", "assignerShortName": "wikimedia-foundation"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-47840 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-10-07T17:12:20.750807Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:wikimedia:mediawiki-apex_skin:*:*:*:*:*:*:*:* (string)

]

vendor : wikimedia (string)

product : mediawiki-apex_skin (string)

versions : [ »

0 : { »

status : affected (string)

version : 1.39.0 (string)

lessThan : 1.39.9 (string)

versionType : semver (string)

}

1 : { »

status : affected (string)

version : 1.41.0 (string)

lessThan : 1.41.3 (string)

versionType : semver (string)

}

2 : { »

status : affected (string)

version : 1.42.0 (string)

lessThan : 1.42.2 (string)

versionType : semver (string)

}

]

defaultStatus : unaffected (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-07T17:15:42.340Z (string)

}

]

cna : { »

title : Stored XSS through sidebar in Apex skin (string)

source : { »

discovery : UNKNOWN (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : R4356th (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-592 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-592 Stored XSS (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV4_0 : { »

Safety : NOT_DEFINED (string)

version : 4.0 (string)

Recovery : NOT_DEFINED (string)

baseScore : 6.9 (number)

Automatable : NOT_DEFINED (string)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N (string)

providerUrgency : NOT_DEFINED (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

privilegesRequired : NONE (string)

subIntegrityImpact : NONE (string)

vulnIntegrityImpact : LOW (string)

subAvailabilityImpact : NONE (string)

vulnAvailabilityImpact : NONE (string)

subConfidentialityImpact : NONE (string)

vulnConfidentialityImpact : LOW (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : The Wikimedia Foundation (string)

product : Mediawiki - Apex skin (string)

versions : [ »

0 : { »

status : affected (string)

version : 1.39.x (string)

lessThan : 1.39.9 (string)

versionType : semver (string)

}

1 : { »

status : affected (string)

version : 1.41.x (string)

lessThan : 1.41.3 (string)

versionType : semver (string)

}

2 : { »

status : affected (string)

version : 1.42.x (string)

lessThan : 1.42.2 (string)

versionType : semver (string)

}

]

defaultStatus : unaffected (string)

}

]

datePublic : 2024-10-05T00:49:00.000Z (string)

references : [ »

0 : { »

url : https://phabricator.wikimedia.org/T368628 (string)

}

1 : { »

url : https://phabricator.wikimedia.org/T370081 (string)

}

2 : { »

url : https://gerrit.wikimedia.org/r/q/Id9093783051c3f8e6dcb5dc89f9493a5f5cf7bd7 (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.This issue affects Mediawiki - Apex skin: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.<p>This issue affects Mediawiki - Apex skin: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.</p> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-79 (string)

description : CWE-79 Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') (string)

}

]

}

]

providerMetadata : { »

orgId : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

shortName : wikimedia-foundation (string)

dateUpdated : 2024-10-05T00:53:38.813Z (string)

}

cveMetadata : { »

cveId : CVE-2024-47840 (string)

state : PUBLISHED (string)

dateUpdated : 2024-10-07T17:15:49.923Z (string)

dateReserved : 2024-10-03T23:44:16.834Z (string)

assignerOrgId : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

datePublished : 2024-10-05T00:53:38.813Z (string)

assignerShortName : wikimedia-foundation (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wikimedia:apex:*:*:*:*:*:*:*:*", "matchCriteriaId": "5352D244-F785-4185-93D0-4E26E413EA9A", "versionEndExcluding": "1.39.9", "versionStartIncluding": "1.13.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wikimedia:apex:*:*:*:*:*:*:*:*", "matchCriteriaId": "9A38851C-C4A4-4A93-96F3-502045E569EF", "versionEndExcluding": "1.41.3", "versionStartIncluding": "1.41.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wikimedia:apex:*:*:*:*:*:*:*:*", "matchCriteriaId": "8A0E8617-B37D-4911-A22A-7E89655CF26F", "versionEndExcluding": "1.42.2", "versionStartIncluding": "1.42.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.This issue affects Mediawiki - Apex skin: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2."}, {"lang": "es", "value": "Vulnerabilidad de neutralizaci\u00f3n inadecuada de la entrada durante la generaci\u00f3n de p\u00e1ginas web (XSS o 'Cross-site Scripting') en The Wikimedia Foundation Mediawiki - Apex skin permite XSS almacenado. Este problema afecta a Mediawiki - Apex skin: desde 1.39.X antes de 1.39.9, desde 1.41.X antes de 1.41.3, desde 1.42.X antes de 1.42.2."}], "id": "CVE-2024-47840", "lastModified": "2024-10-16T16:44:54.440", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.8, "baseSeverity": "MEDIUM", "confidentialityImpact": "LOW", "integrityImpact": "LOW", "privilegesRequired": "HIGH", "scope": "CHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 1.7, "impactScore": 2.7, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "NONE", "vulnerableSystemConfidentiality": "LOW", "vulnerableSystemIntegrity": "LOW"}, "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}]}, "published": "2024-10-05T01:15:12.107", "references": [{"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Patch"], "url": "https://gerrit.wikimedia.org/r/q/Id9093783051c3f8e6dcb5dc89f9493a5f5cf7bd7"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://phabricator.wikimedia.org/T368628"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://phabricator.wikimedia.org/T370081"}], "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-79"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-79"}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:wikimedia:apex:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 5352D244-F785-4185-93D0-4E26E413EA9A (string)

versionEndExcluding : 1.39.9 (string)

versionStartIncluding : 1.13.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:wikimedia:apex:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 9A38851C-C4A4-4A93-96F3-502045E569EF (string)

versionEndExcluding : 1.41.3 (string)

versionStartIncluding : 1.41.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:wikimedia:apex:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 8A0E8617-B37D-4911-A22A-7E89655CF26F (string)

versionEndExcluding : 1.42.2 (string)

versionStartIncluding : 1.42.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Apex skin allows Stored XSS.This issue affects Mediawiki - Apex skin: from 1.39.X before 1.39.9, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2. (string)

}

1 : { »

lang : es (string)

value : Vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web (XSS o 'Cross-site Scripting') en The Wikimedia Foundation Mediawiki - Apex skin permite XSS almacenado. Este problema afecta a Mediawiki - Apex skin: desde 1.39.X antes de 1.39.9, desde 1.41.X antes de 1.41.3, desde 1.42.X antes de 1.42.2. (string)

}

]

id : CVE-2024-47840 (string)

lastModified : 2024-10-16T16:44:54.440 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 4.8 (number)

baseSeverity : MEDIUM (string)

confidentialityImpact : LOW (string)

integrityImpact : LOW (string)

privilegesRequired : HIGH (string)

scope : CHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 1.7 (number)

impactScore : 2.7 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

cvssMetricV40 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : NETWORK (string)

automatable : NOT_DEFINED (string)

availabilityRequirements : NOT_DEFINED (string)

baseScore : 6.9 (number)

baseSeverity : MEDIUM (string)

confidentialityRequirements : NOT_DEFINED (string)

exploitMaturity : NOT_DEFINED (string)

integrityRequirements : NOT_DEFINED (string)

modifiedAttackComplexity : NOT_DEFINED (string)

modifiedAttackRequirements : NOT_DEFINED (string)

modifiedAttackVector : NOT_DEFINED (string)

modifiedPrivilegesRequired : NOT_DEFINED (string)

modifiedSubsequentSystemAvailability : NOT_DEFINED (string)

modifiedSubsequentSystemConfidentiality : NOT_DEFINED (string)

modifiedSubsequentSystemIntegrity : NOT_DEFINED (string)

modifiedUserInteraction : NOT_DEFINED (string)

modifiedVulnerableSystemAvailability : NOT_DEFINED (string)

modifiedVulnerableSystemConfidentiality : NOT_DEFINED (string)

modifiedVulnerableSystemIntegrity : NOT_DEFINED (string)

privilegesRequired : NONE (string)

providerUrgency : NOT_DEFINED (string)

recovery : NOT_DEFINED (string)

safety : NOT_DEFINED (string)

subsequentSystemAvailability : NONE (string)

subsequentSystemConfidentiality : NONE (string)

subsequentSystemIntegrity : NONE (string)

userInteraction : NONE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (string)

version : 4.0 (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

vulnerableSystemAvailability : NONE (string)

vulnerableSystemConfidentiality : LOW (string)

vulnerableSystemIntegrity : LOW (string)

}

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

type : Secondary (string)

}

]

}

published : 2024-10-05T01:15:12.107 (string)

references : [ »

0 : { »

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

tags : [ »

0 : Patch (string)

]

url : https://gerrit.wikimedia.org/r/q/Id9093783051c3f8e6dcb5dc89f9493a5f5cf7bd7 (string)

}

1 : { »

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

tags : [ »

0 : Issue Tracking (string)

1 : Vendor Advisory (string)

]

url : https://phabricator.wikimedia.org/T368628 (string)

}

2 : { »

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

tags : [ »

0 : Exploit (string)

1 : Issue Tracking (string)

2 : Vendor Advisory (string)

]

url : https://phabricator.wikimedia.org/T370081 (string)

}

]

sourceIdentifier : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-79 (string)

}

]

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Changed

Confidentiality Impact Low

Integrity Impact Low

Availability Impact None

User Interaction Required

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object