CVE-2024-29883 - Vulnerability Details - OpenCVE

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Suppression of wiki requests does not work as intended, and always restricts visibility to those with the `(createwiki)` user right regardless of the settings one sets on a given wiki request. This may expose information to users who are not supposed to be able to access it.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Miraheze	Createwiki

No data.

No data.

References

Link	Providers
https://gist.githubusercontent.com/redbluegreenhat/0da1ebb7185b241ce1ac6ba1e8f0b98d/raw/44c4a229aacc8233808c767a79af9e4fd581ae68/T11993.patch
https://github.com/miraheze/CreateWiki/security/advisories/GHSA-8wjf-mxjg-j8p9
https://issue-tracker.miraheze.org/T11993

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2024-03-26T13:37:48.662Z

Updated: 2024-08-02T17:16:09.525Z

Reserved: 2024-03-21T15:12:08.997Z

Link: CVE-2024-29883

Vulnrichment

Updated: 2024-08-02T01:17:58.031Z

NVD

Status : Awaiting Analysis

Published: 2024-03-26T14:15:09.280

Modified: 2024-11-21T09:08:32.667

Link: CVE-2024-29883

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-29883", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-21T15:12:08.997Z", "datePublished": "2024-03-26T13:37:48.662Z", "dateUpdated": "2024-08-02T17:16:09.525Z"}, "containers": {"cna": {"title": "CreateWiki's wiki request suppression ignores the suppression settings set by the suppressor", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/miraheze/CreateWiki/security/advisories/GHSA-8wjf-mxjg-j8p9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/miraheze/CreateWiki/security/advisories/GHSA-8wjf-mxjg-j8p9"}, {"name": "https://gist.githubusercontent.com/redbluegreenhat/0da1ebb7185b241ce1ac6ba1e8f0b98d/raw/44c4a229aacc8233808c767a79af9e4fd581ae68/T11993.patch", "tags": ["x_refsource_MISC"], "url": "https://gist.githubusercontent.com/redbluegreenhat/0da1ebb7185b241ce1ac6ba1e8f0b98d/raw/44c4a229aacc8233808c767a79af9e4fd581ae68/T11993.patch"}, {"name": "https://issue-tracker.miraheze.org/T11993", "tags": ["x_refsource_MISC"], "url": "https://issue-tracker.miraheze.org/T11993"}], "affected": [{"vendor": "miraheze", "product": "CreateWiki", "versions": [{"version": "< 0c7c4f93834349be8f5c2a678e9a85b4b1aa7bab", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-26T13:37:48.662Z"}, "descriptions": [{"lang": "en", "value": "CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Suppression of wiki requests does not work as intended, and always restricts visibility to those with the `(createwiki)` user right regardless of the settings one sets on a given wiki request. This may expose information to users who are not supposed to be able to access it."}], "source": {"advisory": "GHSA-8wjf-mxjg-j8p9", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:17:58.031Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/miraheze/CreateWiki/security/advisories/GHSA-8wjf-mxjg-j8p9", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/miraheze/CreateWiki/security/advisories/GHSA-8wjf-mxjg-j8p9"}, {"name": "https://gist.githubusercontent.com/redbluegreenhat/0da1ebb7185b241ce1ac6ba1e8f0b98d/raw/44c4a229aacc8233808c767a79af9e4fd581ae68/T11993.patch", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://gist.githubusercontent.com/redbluegreenhat/0da1ebb7185b241ce1ac6ba1e8f0b98d/raw/44c4a229aacc8233808c767a79af9e4fd581ae68/T11993.patch"}, {"name": "https://issue-tracker.miraheze.org/T11993", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://issue-tracker.miraheze.org/T11993"}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-08-02T17:15:27.957415Z", "id": "CVE-2024-29883", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T17:16:09.525Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-29883", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2024-03-21T15:12:08.997Z", "datePublished": "2024-03-26T13:37:48.662Z", "dateUpdated": "2024-08-02T17:16:09.525Z"}, "containers": {"cna": {"title": "CreateWiki's wiki request suppression ignores the suppression settings set by the suppressor", "problemTypes": [{"descriptions": [{"cweId": "CWE-200", "lang": "en", "description": "CWE-200: Exposure of Sensitive Information to an Unauthorized Actor", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}}], "references": [{"name": "https://github.com/miraheze/CreateWiki/security/advisories/GHSA-8wjf-mxjg-j8p9", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/miraheze/CreateWiki/security/advisories/GHSA-8wjf-mxjg-j8p9"}, {"name": "https://gist.githubusercontent.com/redbluegreenhat/0da1ebb7185b241ce1ac6ba1e8f0b98d/raw/44c4a229aacc8233808c767a79af9e4fd581ae68/T11993.patch", "tags": ["x_refsource_MISC"], "url": "https://gist.githubusercontent.com/redbluegreenhat/0da1ebb7185b241ce1ac6ba1e8f0b98d/raw/44c4a229aacc8233808c767a79af9e4fd581ae68/T11993.patch"}, {"name": "https://issue-tracker.miraheze.org/T11993", "tags": ["x_refsource_MISC"], "url": "https://issue-tracker.miraheze.org/T11993"}], "affected": [{"vendor": "miraheze", "product": "CreateWiki", "versions": [{"version": "< 0c7c4f93834349be8f5c2a678e9a85b4b1aa7bab", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-03-26T13:37:48.662Z"}, "descriptions": [{"lang": "en", "value": "CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Suppression of wiki requests does not work as intended, and always restricts visibility to those with the `(createwiki)` user right regardless of the settings one sets on a given wiki request. This may expose information to users who are not supposed to be able to access it."}], "source": {"advisory": "GHSA-8wjf-mxjg-j8p9", "discovery": "UNKNOWN"}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T01:17:58.031Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/miraheze/CreateWiki/security/advisories/GHSA-8wjf-mxjg-j8p9", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/miraheze/CreateWiki/security/advisories/GHSA-8wjf-mxjg-j8p9"}, {"name": "https://gist.githubusercontent.com/redbluegreenhat/0da1ebb7185b241ce1ac6ba1e8f0b98d/raw/44c4a229aacc8233808c767a79af9e4fd581ae68/T11993.patch", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://gist.githubusercontent.com/redbluegreenhat/0da1ebb7185b241ce1ac6ba1e8f0b98d/raw/44c4a229aacc8233808c767a79af9e4fd581ae68/T11993.patch"}, {"name": "https://issue-tracker.miraheze.org/T11993", "tags": ["x_refsource_MISC", "x_transferred"], "url": "https://issue-tracker.miraheze.org/T11993"}]}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-29883", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-08-02T17:15:27.957415Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-08-02T17:15:32.986Z"}}]}}

{"descriptions": [{"lang": "en", "value": "CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Suppression of wiki requests does not work as intended, and always restricts visibility to those with the `(createwiki)` user right regardless of the settings one sets on a given wiki request. This may expose information to users who are not supposed to be able to access it."}, {"lang": "es", "value": "CreateWiki es la extensi\u00f3n MediaWiki de Miraheze para solicitar y crear wikis. La supresi\u00f3n de solicitudes de wiki no funciona seg\u00fan lo previsto y siempre restringe la visibilidad a aquellos con el derecho de usuario `(createwiki)`, independientemente de la configuraci\u00f3n que se establezca en una solicitud de wiki determinada. Esto puede exponer la informaci\u00f3n a usuarios que se supone que no pueden acceder a ella."}], "id": "CVE-2024-29883", "lastModified": "2024-11-21T09:08:32.667", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 4.9, "baseSeverity": "MEDIUM", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 3.6, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-03-26T14:15:09.280", "references": [{"source": "security-advisories@github.com", "url": "https://gist.githubusercontent.com/redbluegreenhat/0da1ebb7185b241ce1ac6ba1e8f0b98d/raw/44c4a229aacc8233808c767a79af9e4fd581ae68/T11993.patch"}, {"source": "security-advisories@github.com", "url": "https://github.com/miraheze/CreateWiki/security/advisories/GHSA-8wjf-mxjg-j8p9"}, {"source": "security-advisories@github.com", "url": "https://issue-tracker.miraheze.org/T11993"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://gist.githubusercontent.com/redbluegreenhat/0da1ebb7185b241ce1ac6ba1e8f0b98d/raw/44c4a229aacc8233808c767a79af9e4fd581ae68/T11993.patch"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://github.com/miraheze/CreateWiki/security/advisories/GHSA-8wjf-mxjg-j8p9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://issue-tracker.miraheze.org/T11993"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-200"}], "source": "security-advisories@github.com", "type": "Secondary"}]}