CVE-2024-47536

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)

Published: Sep 30, 2024 / Updated: 50d ago

010
CVSS 4.8EPSS 0.05%Medium
CVE info copied to clipboard

Summary

A vulnerability in the Citizen MediaWiki skin allows users with the editmyprivateinfo right or the ability to change their name to perform a self-XSS attack by setting their "real name" to an XSS payload.

Impact

This vulnerability could allow an attacker to execute malicious scripts in the context of the victim's browser, potentially leading to theft of sensitive information, session hijacking, or other malicious actions within the user's authenticated session. The impact is limited to self-XSS, meaning the attacker can only target their own account.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. The vulnerability is fixed in version 2.31.0 of the Citizen MediaWiki skin.

Mitigation

1. Update the Citizen MediaWiki skin to version 2.31.0 or later. 2. If immediate updating is not possible, consider temporarily revoking the editmyprivateinfo right from users who don't absolutely need it. 3. Implement input validation and output encoding for user-supplied data, especially in fields like "real name" that may be displayed on the wiki. 4. Educate users about the risks of inserting potentially malicious content into their profile fields.

CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Timeline

Vendor Advisory

GitHub Advisories released a security advisory.

Sep 28, 2024 at 9:40 PM
CVE Assignment

NVD published the first details for CVE-2024-47536

Sep 30, 2024 at 5:15 PM
CVSS

A CVSS base score of 4.8 has been assigned.

Sep 30, 2024 at 5:20 PM / nvd
First Article

Feedly found the first article mentioning CVE-2024-47536. See article

Sep 30, 2024 at 5:22 PM / National Vulnerability Database
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Sep 30, 2024 at 5:22 PM
EPSS

EPSS Score was set to: 0.05% (Percentile: 16.3%)

Oct 1, 2024 at 10:17 AM
CVSS

A CVSS base score of 4.8 has been assigned.

Oct 4, 2024 at 1:55 PM / nvd
Static CVE Timeline Graph

Patches

Github Advisory
+null more

Attack Patterns

CAPEC-209: XSS Using MIME Type Mismatch
+null more

Vendor Advisory

[GHSA-62r2-gcxr-426x] starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field
Package: starcitizentools/citizen-skin Save your settings and use Citizen if it's not being used already

News

CVE-2024-47536
Medium Severity Description Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. This vulnerability is fixed in 2.31.0. Read more at https://www.tenable.com/cve/CVE-2024-47536
NA - CVE-2024-47536 - Citizen is a MediaWiki skin that makes...
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their...
CVE-2024-47536 starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. This vulnerability is fixed in...
[GHSA-62r2-gcxr-426x] starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field
Package: starcitizentools/citizen-skin Save your settings and use Citizen if it's not being used already
CVE-2024-47536 | StarCitizenTools mediawiki-skins-Citizen up to 2.30.x Setting real name cross site scripting (GHSA-62r2-gcxr-426x)
A vulnerability has been found in StarCitizenTools mediawiki-skins-Citizen up to 2.30.x and classified as problematic . This vulnerability affects unknown code of the component Setting Handler . The manipulation of the argument real name leads to basic cross site scripting. This vulnerability was named CVE-2024-47536 . The attack can be initiated remotely. There is no exploit available. It is recommended to upgrade the affected component.
See 3 more articles and social media posts

CVSS V3.1

Unknown

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI