CVE-2024-47781

Cross-site Scripting (XSS) in Special:RequestWikiQueue when displaying sitename in CreateWiki

Description

CreateWiki is an extension used at Miraheze for requesting & creating wikis. The name of requested wikis is not escaped on Special:RequestWikiQueue, so a user can insert arbitrary HTML that is displayed in the request wiki queue when requesting a wiki. If a wiki creator comes across the XSS payload, their user session can be abused to retrieve deleted wiki requests, which typically contains private information. Likewise, this can also be abused on those with the ability to suppress requests to view sensitive information. This issue has been patched with commit `693a220` and all users are advised to apply the patch. Users unable to upgrade should disable Javascript and/or prevent access to the vulnerable page (Special:RequestWikiQueue).

Category

5.3
CVSS
Severity: Medium
CVSS 4.0 •
CVSS 3.1 •
EPSS 0.11%
Vendor Advisory github.com
Affected: miraheze CreateWiki
Published at:
Updated at:

References

Link Tags
https://github.com/miraheze/CreateWiki/security/advisories/GHSA-h527-jh77-5g7j vendor advisory
https://github.com/miraheze/CreateWiki/commit/693a220f399ee7eb4d00e77c3c667e864b1bd306 patch
https://issue-tracker.miraheze.org/T12693 product issue tracking

Frequently Asked Questions

What is the severity of CVE-2024-47781?
CVE-2024-47781 has been scored as a medium severity vulnerability.
How to fix CVE-2024-47781?
To fix CVE-2024-47781, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2024-47781 being actively exploited in the wild?
As for now, there are no information to confirm that CVE-2024-47781 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.
What software or system is affected by CVE-2024-47781?
CVE-2024-47781 affects miraheze CreateWiki.
This platform uses data from the NIST NVD, MITRE CVE, MITRE CWE, First.org and CISA KEV but is not endorsed or certified by these entities. CVE is a registred trademark of the MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. CWE is a registred trademark of the MITRE Corporation and the authoritative source of CWE content is MITRE's CWE web site.
© 2025 Under My Watch. All Rights Reserved.