CVE-2024-47913: MediaWiki AbuseFilter Improper Permissions Handling Vulnerability
Summary
CVE-2024-47913: Improper permissions handling in MediaWiki AbuseFilter. Affects mediawiki/abuse-filter across 3 version ranges.
< 1.39.9
>= 1.40.0, < 1.41.3
>= 1.42.0, < 1.42.2
Fixed in 1.39.9, 1.41.3 or 1.42.2, depending on the release line you run. How to fix ↓
Also tracked for
- mediawiki · Debian:12
The same CVE-2024-47913 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MediaWiki is a widely used open-source wiki software platform that allows users to create and manage collaborative content. The AbuseFilter extension is a critical component of MediaWiki that helps in identifying and preventing abusive edits by applying filters to user actions. However, prior versions of this extension have been found to have a vulnerability that allows unauthorized API callers to access sensitive log details, undermining the security of the platform.
Vulnerability Detail
The vulnerability arises from improper permissions handling in the AbuseFilter extension for MediaWiki versions before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can match a filter condition against AbuseFilter logs even if they are not authorized to view the log details for that filter. This could lead to unauthorized access to sensitive information, potentially allowing malicious users to exploit the system further.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 1.39.91.39.9composer require mediawiki/abuse-filter:1.39.9 -
>= 1.40.0, < 1.41.31.41.3composer require mediawiki/abuse-filter:1.41.3 -
>= 1.42.0, < 1.42.21.42.2composer require mediawiki/abuse-filter:1.42.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, administrators can restrict API access to the AbuseFilter logs by implementing stricter access controls and ensuring that only authorized users are allowed to interact with the API endpoints related to the AbuseFilter extension.
Conclusion
The CVE-2024-47913 vulnerability in the MediaWiki AbuseFilter extension poses a significant risk by allowing unauthorized access to sensitive log information. It is crucial for users to update to the latest patched versions to mitigate this risk and ensure the security of their MediaWiki installations.
See every vulnerability recorded for mediawiki/abuse-filter →
FAQ
CVE-2024-47913 is a vulnerability in the MediaWiki AbuseFilter extension that allows unauthorized API callers to access sensitive log details.
The vulnerability affects MediaWiki AbuseFilter versions before 1.39.9, 1.40.x, 1.41.x before 1.41.3, and 1.42.x before 1.42.2.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of this vulnerability is 5.3, indicating a moderate severity level.
If immediate updates are not possible, consider implementing stricter access controls as a temporary workaround to limit unauthorized access.
