CVE-2024-25107

    Dashboard / Vulnerabilities / CVE-2024-25107

    CVE-2024-25107

    Published: 8 Feb 2024Last Modified: 28 Oct 2026

    Summary: Cross-Site Scripting in WikiDiscover

    Details: WikiDiscover is an extension designed for use with a CreateWiki managed farm to display wikis. On Special:WikiDiscover, the `Language::date` function is used when making the human-readable timestamp for inclusion on the wiki_creation column. This function uses interface messages to translate the names of months and days. It uses the `->text()` output mode, returning unescaped interface messages. Since the output is not escaped later, the unescaped interface message is included on the output, resulting in an XSS vulnerability. Exploiting this on-wiki requires the `(editinterface)` right. This vulnerability has been addressed in commit `267e763a0`. Users are advised to update their installations. There are no known workarounds for this vulnerability.

    References: https://issue-tracker.miraheze.org/T11814, https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/25xxx/CVE-2024-25107.json, https://github.com/miraheze/WikiDiscover/security/advisories/GHSA-cfcf-94jv-455f, https://nvd.nist.gov/vuln/detail/CVE-2024-25107, https://github.com/miraheze/WikiDiscover/commit/267e763a0d7460f001693c42f67717a0fc3fd6bb

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -267e763a0d7460f001693c42f67717a0fc3fd6bb

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2024-25107 | CVE-DB