CVE-2024-47841 - Vulnerability Details

Vendors	Products
Wikimedia	Mediawiki-extensions-css Wikimedia-extensions-css

Link	Providers
https://gerrit.wikimedia.org/r/q/I46613d8d50fc978bdac58e2b312ee03324c1edc8
https://phabricator.wikimedia.org/T368628
https://phabricator.wikimedia.org/T369486

Type	Values Removed	Values Added
First Time appeared		Wikimedia wikimedia-extensions-css
CPEs		cpe:2.3:a:wikimedia:wikimedia-extensions-css::::::::
Vendors & Products		Wikimedia wikimedia-extensions-css
Metrics		cvssV3_1 `{'score': 7.5, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N'}`

Type	Values Removed	Values Added
First Time appeared		Wikimedia Wikimedia mediawiki-extensions-css
CPEs		cpe:2.3:a:wikimedia:mediawiki-extensions-css::::::::
Vendors & Products		Wikimedia Wikimedia mediawiki-extensions-css
Metrics		ssvc `{'options': {'Automatable': 'yes', 'Exploitation': 'poc', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

Type	Values Removed	Values Added
Description		Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9.
Title		Path traversal when loading stylesheets
Weaknesses		CWE-22
References		https://gerrit.wikimedia.org/r/q/I46613d8d50fc978bdac58e2b312ee03324c1edc8 https://phabricator.wikimedia.org/T368628 https://phabricator.wikimedia.org/T369486
Metrics		cvssV4_0 `{'score': 6.9, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2024-47841", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "state": "PUBLISHED", "assignerShortName": "wikimedia-foundation", "dateReserved": "2024-10-03T23:44:16.834Z", "datePublished": "2024-10-05T01:02:31.642Z", "dateUpdated": "2024-10-07T17:10:52.526Z"}, "containers": {"cna": {"affected": [{"defaultStatus": "unaffected", "product": "Mediawiki - CSS Extension", "vendor": "The Wikimedia Foundation", "versions": [{"lessThan": "1.42.2", "status": "affected", "version": "1.42.x", "versionType": "semver"}, {"lessThan": "1.41.3", "status": "affected", "version": "1.41.x", "versionType": "semver"}, {"lessThan": "1.39.9", "status": "affected", "version": "1.39.x", "versionType": "semver"}]}], "credits": [{"lang": "en", "type": "finder", "value": "RhinosF1"}, {"lang": "en", "type": "finder", "value": "BlankEclair"}], "datePublic": "2024-10-04T00:55:00.000Z", "descriptions": [{"lang": "en", "supportingMedia": [{"base64": false, "type": "text/html", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.<p>This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9.</p>"}], "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9."}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "metrics": [{"cvssV4_0": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "baseScore": 6.9, "baseSeverity": "MEDIUM", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "problemTypes": [{"descriptions": [{"cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2024-10-05T01:02:31.642Z"}, "references": [{"url": "https://phabricator.wikimedia.org/T368628"}, {"url": "https://phabricator.wikimedia.org/T369486"}, {"url": "https://gerrit.wikimedia.org/r/q/I46613d8d50fc978bdac58e2b312ee03324c1edc8"}], "source": {"discovery": "UNKNOWN"}, "title": "Path traversal when loading stylesheets", "x_generator": {"engine": "Vulnogram 0.2.0"}}, "adp": [{"affected": [{"vendor": "wikimedia", "product": "mediawiki-extensions-css", "cpes": ["cpe:2.3:a:wikimedia:mediawiki-extensions-css:*:*:*:*:*:*:*:*"], "defaultStatus": "unaffected", "versions": [{"version": "1.42.0", "status": "affected", "lessThan": "1.42.2", "versionType": "semver"}, {"version": "1.41.0", "status": "affected", "lessThan": "1.41.3", "versionType": "semver"}, {"version": "1.39.0", "status": "affected", "lessThan": "1.39.9", "versionType": "semver"}]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-07T17:06:16.157977Z", "id": "CVE-2024-47841", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-07T17:10:52.526Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

cveId : CVE-2024-47841 (string)

assignerOrgId : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

state : PUBLISHED (string)

assignerShortName : wikimedia-foundation (string)

dateReserved : 2024-10-03T23:44:16.834Z (string)

datePublished : 2024-10-05T01:02:31.642Z (string)

dateUpdated : 2024-10-07T17:10:52.526Z (string)

}

containers : { »

cna : { »

affected : [ »

0 : { »

defaultStatus : unaffected (string)

product : Mediawiki - CSS Extension (string)

vendor : The Wikimedia Foundation (string)

versions : [ »

0 : { »

lessThan : 1.42.2 (string)

status : affected (string)

version : 1.42.x (string)

versionType : semver (string)

}

1 : { »

lessThan : 1.41.3 (string)

status : affected (string)

version : 1.41.x (string)

versionType : semver (string)

}

2 : { »

lessThan : 1.39.9 (string)

status : affected (string)

version : 1.39.x (string)

versionType : semver (string)

}

]

}

]

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : RhinosF1 (string)

}

1 : { »

lang : en (string)

type : finder (string)

value : BlankEclair (string)

}

]

datePublic : 2024-10-04T00:55:00.000Z (string)

descriptions : [ »

0 : { »

lang : en (string)

supportingMedia : [ »

0 : { »

base64 : false (boolean)

type : text/html (string)

value : Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.<p>This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9.</p> (string)

}

]

value : Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9. (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-126 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-126 Path Traversal (string)

}

]

}

]

metrics : [ »

0 : { »

cvssV4_0 : { »

Automatable : NOT_DEFINED (string)

Recovery : NOT_DEFINED (string)

Safety : NOT_DEFINED (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : NETWORK (string)

baseScore : 6.9 (number)

baseSeverity : MEDIUM (string)

privilegesRequired : NONE (string)

providerUrgency : NOT_DEFINED (string)

subAvailabilityImpact : NONE (string)

subConfidentialityImpact : NONE (string)

subIntegrityImpact : NONE (string)

userInteraction : NONE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N (string)

version : 4.0 (string)

vulnAvailabilityImpact : NONE (string)

vulnConfidentialityImpact : LOW (string)

vulnIntegrityImpact : LOW (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

cweId : CWE-22 (string)

description : CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (string)

lang : en (string)

type : CWE (string)

}

]

}

]

providerMetadata : { »

orgId : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

shortName : wikimedia-foundation (string)

dateUpdated : 2024-10-05T01:02:31.642Z (string)

}

references : [ »

0 : { »

url : https://phabricator.wikimedia.org/T368628 (string)

}

1 : { »

url : https://phabricator.wikimedia.org/T369486 (string)

}

2 : { »

url : https://gerrit.wikimedia.org/r/q/I46613d8d50fc978bdac58e2b312ee03324c1edc8 (string)

}

]

source : { »

discovery : UNKNOWN (string)

}

title : Path traversal when loading stylesheets (string)

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

adp : [ »

0 : { »

affected : [ »

0 : { »

vendor : wikimedia (string)

product : mediawiki-extensions-css (string)

cpes : [ »

0 : cpe:2.3:a:wikimedia:mediawiki-extensions-css:*:*:*:*:*:*:*:* (string)

]

defaultStatus : unaffected (string)

versions : [ »

0 : { »

version : 1.42.0 (string)

status : affected (string)

lessThan : 1.42.2 (string)

versionType : semver (string)

}

1 : { »

version : 1.41.0 (string)

status : affected (string)

lessThan : 1.41.3 (string)

versionType : semver (string)

}

2 : { »

version : 1.39.0 (string)

status : affected (string)

lessThan : 1.39.9 (string)

versionType : semver (string)

}

]

}

]

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-10-07T17:06:16.157977Z (string)

id : CVE-2024-47841 (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-07T17:10:52.526Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2024-47841", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-10-07T17:06:16.157977Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:wikimedia:mediawiki-extensions-css:*:*:*:*:*:*:*:*"], "vendor": "wikimedia", "product": "mediawiki-extensions-css", "versions": [{"status": "affected", "version": "1.42.0", "lessThan": "1.42.2", "versionType": "semver"}, {"status": "affected", "version": "1.41.0", "lessThan": "1.41.3", "versionType": "semver"}, {"status": "affected", "version": "1.39.0", "lessThan": "1.39.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-07T17:10:46.199Z"}}], "cna": {"title": "Path traversal when loading stylesheets", "source": {"discovery": "UNKNOWN"}, "credits": [{"lang": "en", "type": "finder", "value": "RhinosF1"}, {"lang": "en", "type": "finder", "value": "BlankEclair"}], "impacts": [{"capecId": "CAPEC-126", "descriptions": [{"lang": "en", "value": "CAPEC-126 Path Traversal"}]}], "metrics": [{"format": "CVSS", "cvssV4_0": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"vendor": "The Wikimedia Foundation", "product": "Mediawiki - CSS Extension", "versions": [{"status": "affected", "version": "1.42.x", "lessThan": "1.42.2", "versionType": "semver"}, {"status": "affected", "version": "1.41.x", "lessThan": "1.41.3", "versionType": "semver"}, {"status": "affected", "version": "1.39.x", "lessThan": "1.39.9", "versionType": "semver"}], "defaultStatus": "unaffected"}], "datePublic": "2024-10-04T00:55:00.000Z", "references": [{"url": "https://phabricator.wikimedia.org/T368628"}, {"url": "https://phabricator.wikimedia.org/T369486"}, {"url": "https://gerrit.wikimedia.org/r/q/I46613d8d50fc978bdac58e2b312ee03324c1edc8"}], "x_generator": {"engine": "Vulnogram 0.2.0"}, "descriptions": [{"lang": "en", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9.", "supportingMedia": [{"type": "text/html", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.<p>This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-22", "description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"}]}], "providerMetadata": {"orgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "shortName": "wikimedia-foundation", "dateUpdated": "2024-10-05T01:02:31.642Z"}}}, "cveMetadata": {"cveId": "CVE-2024-47841", "state": "PUBLISHED", "dateUpdated": "2024-10-07T17:10:52.526Z", "dateReserved": "2024-10-03T23:44:16.834Z", "assignerOrgId": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "datePublished": "2024-10-05T01:02:31.642Z", "assignerShortName": "wikimedia-foundation"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2024-47841 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : poc (string)

}

1 : { »

Automatable : yes (string)

}

2 : { »

Technical Impact : partial (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-10-07T17:06:16.157977Z (string)

}

]

affected : [ »

0 : { »

cpes : [ »

0 : cpe:2.3:a:wikimedia:mediawiki-extensions-css:*:*:*:*:*:*:*:* (string)

]

vendor : wikimedia (string)

product : mediawiki-extensions-css (string)

versions : [ »

0 : { »

status : affected (string)

version : 1.42.0 (string)

lessThan : 1.42.2 (string)

versionType : semver (string)

}

1 : { »

status : affected (string)

version : 1.41.0 (string)

lessThan : 1.41.3 (string)

versionType : semver (string)

}

2 : { »

status : affected (string)

version : 1.39.0 (string)

lessThan : 1.39.9 (string)

versionType : semver (string)

}

]

defaultStatus : unaffected (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-07T17:10:46.199Z (string)

}

]

cna : { »

title : Path traversal when loading stylesheets (string)

source : { »

discovery : UNKNOWN (string)

}

credits : [ »

0 : { »

lang : en (string)

type : finder (string)

value : RhinosF1 (string)

}

1 : { »

lang : en (string)

type : finder (string)

value : BlankEclair (string)

}

]

impacts : [ »

0 : { »

capecId : CAPEC-126 (string)

descriptions : [ »

0 : { »

lang : en (string)

value : CAPEC-126 Path Traversal (string)

}

]

}

]

metrics : [ »

0 : { »

format : CVSS (string)

cvssV4_0 : { »

Safety : NOT_DEFINED (string)

version : 4.0 (string)

Recovery : NOT_DEFINED (string)

baseScore : 6.9 (number)

Automatable : NOT_DEFINED (string)

attackVector : NETWORK (string)

baseSeverity : MEDIUM (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N (string)

providerUrgency : NOT_DEFINED (string)

userInteraction : NONE (string)

attackComplexity : LOW (string)

attackRequirements : NONE (string)

privilegesRequired : NONE (string)

subIntegrityImpact : NONE (string)

vulnIntegrityImpact : LOW (string)

subAvailabilityImpact : NONE (string)

vulnAvailabilityImpact : NONE (string)

subConfidentialityImpact : NONE (string)

vulnConfidentialityImpact : LOW (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

}

scenarios : [ »

0 : { »

lang : en (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : The Wikimedia Foundation (string)

product : Mediawiki - CSS Extension (string)

versions : [ »

0 : { »

status : affected (string)

version : 1.42.x (string)

lessThan : 1.42.2 (string)

versionType : semver (string)

}

1 : { »

status : affected (string)

version : 1.41.x (string)

lessThan : 1.41.3 (string)

versionType : semver (string)

}

2 : { »

status : affected (string)

version : 1.39.x (string)

lessThan : 1.39.9 (string)

versionType : semver (string)

}

]

defaultStatus : unaffected (string)

}

]

datePublic : 2024-10-04T00:55:00.000Z (string)

references : [ »

0 : { »

url : https://phabricator.wikimedia.org/T368628 (string)

}

1 : { »

url : https://phabricator.wikimedia.org/T369486 (string)

}

2 : { »

url : https://gerrit.wikimedia.org/r/q/I46613d8d50fc978bdac58e2b312ee03324c1edc8 (string)

}

]

x_generator : { »

engine : Vulnogram 0.2.0 (string)

}

descriptions : [ »

0 : { »

lang : en (string)

value : Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9. (string)

supportingMedia : [ »

0 : { »

type : text/html (string)

value : Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.<p>This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9.</p> (string)

base64 : false (boolean)

}

]

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en (string)

type : CWE (string)

cweId : CWE-22 (string)

description : CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (string)

}

]

}

]

providerMetadata : { »

orgId : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

shortName : wikimedia-foundation (string)

dateUpdated : 2024-10-05T01:02:31.642Z (string)

}

cveMetadata : { »

cveId : CVE-2024-47841 (string)

state : PUBLISHED (string)

dateUpdated : 2024-10-07T17:10:52.526Z (string)

dateReserved : 2024-10-03T23:44:16.834Z (string)

assignerOrgId : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

datePublished : 2024-10-05T01:02:31.642Z (string)

assignerShortName : wikimedia-foundation (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:wikimedia:wikimedia-extensions-css:*:*:*:*:*:*:*:*", "matchCriteriaId": "8C84CC2C-175C-43B2-B687-1F3059E25426", "versionEndExcluding": "1.39.9", "versionStartIncluding": "1.39.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wikimedia:wikimedia-extensions-css:*:*:*:*:*:*:*:*", "matchCriteriaId": "3C653764-2F82-4DFA-8679-44040C0EB5CB", "versionEndExcluding": "1.41.3", "versionStartIncluding": "1.41.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:wikimedia:wikimedia-extensions-css:*:*:*:*:*:*:*:*", "matchCriteriaId": "38BB6671-A00E-418E-BAD8-BA54401F0E6A", "versionEndExcluding": "1.42.2", "versionStartIncluding": "1.42.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9."}, {"lang": "es", "value": "La vulnerabilidad de limitaci\u00f3n incorrecta de una ruta a un directorio restringido ('Path Traversal') vulnerabilidad en The Wikimedia Foundation Mediawiki - CSS Extension permite Path Traversal. Este problema afecta a Mediawiki - CSS Extension: desde 1.42.X antes de 1.42.2, desde 1.41.X antes de 1.41.3, desde 1.39.X antes de 1.39.9."}], "id": "CVE-2024-47841", "lastModified": "2024-10-16T16:34:31.173", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "NONE", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 3.6, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "automatable": "NOT_DEFINED", "availabilityRequirements": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirements": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirements": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubsequentSystemAvailability": "NOT_DEFINED", "modifiedSubsequentSystemConfidentiality": "NOT_DEFINED", "modifiedSubsequentSystemIntegrity": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnerableSystemAvailability": "NOT_DEFINED", "modifiedVulnerableSystemConfidentiality": "NOT_DEFINED", "modifiedVulnerableSystemIntegrity": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "recovery": "NOT_DEFINED", "safety": "NOT_DEFINED", "subsequentSystemAvailability": "NONE", "subsequentSystemConfidentiality": "NONE", "subsequentSystemIntegrity": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnerabilityResponseEffort": "NOT_DEFINED", "vulnerableSystemAvailability": "NONE", "vulnerableSystemConfidentiality": "LOW", "vulnerableSystemIntegrity": "LOW"}, "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}]}, "published": "2024-10-05T02:15:02.470", "references": [{"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Patch"], "url": "https://gerrit.wikimedia.org/r/q/I46613d8d50fc978bdac58e2b312ee03324c1edc8"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Issue Tracking", "Vendor Advisory"], "url": "https://phabricator.wikimedia.org/T368628"}, {"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "tags": ["Exploit", "Issue Tracking", "Vendor Advisory"], "url": "https://phabricator.wikimedia.org/T369486"}], "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-22"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-22"}], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "type": "Secondary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:wikimedia:wikimedia-extensions-css:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 8C84CC2C-175C-43B2-B687-1F3059E25426 (string)

versionEndExcluding : 1.39.9 (string)

versionStartIncluding : 1.39.0 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:wikimedia:wikimedia-extensions-css:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 3C653764-2F82-4DFA-8679-44040C0EB5CB (string)

versionEndExcluding : 1.41.3 (string)

versionStartIncluding : 1.41.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:wikimedia:wikimedia-extensions-css:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 38BB6671-A00E-418E-BAD8-BA54401F0E6A (string)

versionEndExcluding : 1.42.2 (string)

versionStartIncluding : 1.42.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9. (string)

}

1 : { »

lang : es (string)

value : La vulnerabilidad de limitación incorrecta de una ruta a un directorio restringido ('Path Traversal') vulnerabilidad en The Wikimedia Foundation Mediawiki - CSS Extension permite Path Traversal. Este problema afecta a Mediawiki - CSS Extension: desde 1.42.X antes de 1.42.2, desde 1.41.X antes de 1.41.3, desde 1.39.X antes de 1.39.9. (string)

}

]

id : CVE-2024-47841 (string)

lastModified : 2024-10-16T16:34:31.173 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : NONE (string)

baseScore : 7.5 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : NONE (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (string)

version : 3.1 (string)

}

exploitabilityScore : 3.9 (number)

impactScore : 3.6 (number)

source : nvd@nist.gov (string)

type : Primary (string)

}

]

cvssMetricV40 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackRequirements : NONE (string)

attackVector : NETWORK (string)

automatable : NOT_DEFINED (string)

availabilityRequirements : NOT_DEFINED (string)

baseScore : 6.9 (number)

baseSeverity : MEDIUM (string)

confidentialityRequirements : NOT_DEFINED (string)

exploitMaturity : NOT_DEFINED (string)

integrityRequirements : NOT_DEFINED (string)

modifiedAttackComplexity : NOT_DEFINED (string)

modifiedAttackRequirements : NOT_DEFINED (string)

modifiedAttackVector : NOT_DEFINED (string)

modifiedPrivilegesRequired : NOT_DEFINED (string)

modifiedSubsequentSystemAvailability : NOT_DEFINED (string)

modifiedSubsequentSystemConfidentiality : NOT_DEFINED (string)

modifiedSubsequentSystemIntegrity : NOT_DEFINED (string)

modifiedUserInteraction : NOT_DEFINED (string)

modifiedVulnerableSystemAvailability : NOT_DEFINED (string)

modifiedVulnerableSystemConfidentiality : NOT_DEFINED (string)

modifiedVulnerableSystemIntegrity : NOT_DEFINED (string)

privilegesRequired : NONE (string)

providerUrgency : NOT_DEFINED (string)

recovery : NOT_DEFINED (string)

safety : NOT_DEFINED (string)

subsequentSystemAvailability : NONE (string)

subsequentSystemConfidentiality : NONE (string)

subsequentSystemIntegrity : NONE (string)

userInteraction : NONE (string)

valueDensity : NOT_DEFINED (string)

vectorString : CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X (string)

version : 4.0 (string)

vulnerabilityResponseEffort : NOT_DEFINED (string)

vulnerableSystemAvailability : NONE (string)

vulnerableSystemConfidentiality : LOW (string)

vulnerableSystemIntegrity : LOW (string)

}

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

type : Secondary (string)

}

]

}

published : 2024-10-05T02:15:02.470 (string)

references : [ »

0 : { »

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

tags : [ »

0 : Patch (string)

]

url : https://gerrit.wikimedia.org/r/q/I46613d8d50fc978bdac58e2b312ee03324c1edc8 (string)

}

1 : { »

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

tags : [ »

0 : Issue Tracking (string)

1 : Vendor Advisory (string)

]

url : https://phabricator.wikimedia.org/T368628 (string)

}

2 : { »

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

tags : [ »

0 : Exploit (string)

1 : Issue Tracking (string)

2 : Vendor Advisory (string)

]

url : https://phabricator.wikimedia.org/T369486 (string)

}

]

sourceIdentifier : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

vulnStatus : Analyzed (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-22 (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

1 : { »

description : [ »

0 : { »

lang : en (string)

value : CWE-22 (string)

}

]

source : c4f26cc8-17ff-4c99-b5e2-38fc1793eacc (string)

type : Secondary (string)

}

]

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required None

Attack Requirements None

User Interaction None

Vulnerable System Confidentiality Impact Low

Vulnerable System Integrity Impact Low

Vulnerable System Availability Impact None

Subsequent System Confidentiality Impact None

Subsequent System Integrity Impact None

Subsequent System Availability Impact None

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact None

Availability Impact None

User Interaction None

Exploitation poc

Automatable yes

Technical Impact partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object