Lucene search

K
nvd[email protected]NVD:CVE-2024-29883
HistoryMar 26, 2024 - 2:15 p.m.

CVE-2024-29883

2024-03-2614:15:09
CWE-200
web.nvd.nist.gov
5
cve-2024-29883
miraheze
createwiki
extension
vulnerability
visibility
information exposure
user access

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

4.9

Confidence

High

EPSS

0

Percentile

15.5%

CreateWiki is Miraheze’s MediaWiki extension for requesting & creating wikis. Suppression of wiki requests does not work as intended, and always restricts visibility to those with the (createwiki) user right regardless of the settings one sets on a given wiki request. This may expose information to users who are not supposed to be able to access it.

CVSS3

4.9

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

AI Score

4.9

Confidence

High

EPSS

0

Percentile

15.5%

Related for NVD:CVE-2024-29883