Skip to content

XSS in Special:DataDump when displaying dump status

Low
BlankEclair published GHSA-h8x8-24c7-r2rj Oct 2, 2024

Package

DataDump (MediaWiki)

Affected versions

< 601688ee8e8808a23b102fa305b178f27cbd226d

Patched versions

601688ee8e8808a23b102fa305b178f27cbd226d

Description

Impact

Several interface messages are unescaped (more specifically, (datadump-table-column-queued), (datadump-table-column-in-progress), (datadump-table-column-completed), (datadump-table-column-failed)). If these messages are edited (which requires the (editinterface) right by default), anyone who can view Special:DataDump (which requires the (view-dump) right by default) can be XSSed.

Patches

You should either update DataDump to the latest version or apply the patch.

Workarounds

If an interface administrator (or equivalent) level protection is available (which is not provided by default), protect the affected messages up to that level. This causes the XSS to be virtually useless as users with those rights can already edit Javascript pages.

References

Severity

Low

CVSS overall score

This score calculates overall vulnerability severity from 0 to 10 and is based on the Common Vulnerability Scoring System (CVSS).
/ 10

CVSS v3 base metrics

Attack vector
Network
Attack complexity
Low
Privileges required
High
User interaction
Required
Scope
Unchanged
Confidentiality
Low
Integrity
Low
Availability
None

CVSS v3 base metrics

Attack vector: More severe the more the remote (logically and physically) an attacker can be in order to exploit the vulnerability.
Attack complexity: More severe for the least complex attacks.
Privileges required: More severe if no privileges are required.
User interaction: More severe when no user interaction is required.
Scope: More severe when a scope change occurs, e.g. one vulnerable component impacts resources in components beyond its security scope.
Confidentiality: More severe when loss of data confidentiality is highest, measuring the level of data access available to an unauthorized user.
Integrity: More severe when loss of data integrity is the highest, measuring the consequence of data modification possible by an unauthorized user.
Availability: More severe when the loss of impacted component availability is highest.
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:L/A:N

CVE ID

CVE-2024-47612

Weaknesses

Credits