CVE-2024-40596

An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The Special:Investigate feature can expose suppressed information for log events. TimelineService does not support properly suppressing...

PT-2024-28937 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWikiChat extension for MediaWiki versions through 1.42.1 Description: An issue was discovered in the MediaWikiChat extension for MediaWiki, where CSRF can occur in API modules. Recommendations: For MediaWikiChat extension for MediaWiki...

CVE-2024-40601

The CVE-2024-40601 entry concerns the MediaWikiChat extension for MediaWiki up to version 1.42.1, with a CSRF vulnerability in API modules. Affected component: MediaWikiChat extension (MediaWiki). Root cause stated: CSRF risk in API modules. Impact indicators from CVSS: integrity impact HIGH whil...

CVE-2024-40602

An issue was discovered in the Tempo skin for MediaWiki through 1.42.1. There is stored XSS via MediaWiki:Sidebar top-level menu entries...

CVE-2024-40598

An issue was discovered in the CheckUser extension for MediaWiki through 1.42.1. The API can expose suppressed information for log events. The logdeleted attribute is not applied to entries...