CVE-2022-24813 - Vulnerability Details - OpenCVE

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:RequestWikiQueue when sent directly via POST. A patch for this issue is available in the `master` branch of CreateWiki's GitHub repository.

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact None

Integrity Impact Low

Availability Impact None

User Interaction None

No CVSS v3.0

Access Vector Network

Access Complexity Low

Authentication None

Confidentiality Impact None

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Miraheze	Createwiki

Configuration 1 [-]

cpe:2.3:a:miraheze:createwiki:*:*:*:*:*:*:*:*

No data.

References

Link	Providers
https://github.com/miraheze/CreateWiki/commit/d0ae79843d689832ccac765d6b1721e668d99ab9
https://github.com/miraheze/CreateWiki/security/advisories/GHSA-9xvw-w66v-prvg
https://phabricator.miraheze.org/T9018

History

No history.

MITRE

Status: PUBLISHED

Assigner: GitHub_M

Published: 2022-04-04T17:40:11

Updated: 2024-08-03T04:20:50.617Z

Reserved: 2022-02-10T00:00:00

Link: CVE-2022-24813

Vulnrichment

No data.

NVD

Status : Modified

Published: 2022-04-04T18:15:07.993

Modified: 2024-11-21T06:51:09.340

Link: CVE-2022-24813

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "CreateWiki", "vendor": "miraheze", "versions": [{"status": "affected", "version": "< d0ae79843d689832ccac765d6b1721e668d99ab9"}]}], "descriptions": [{"lang": "en", "value": "CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:RequestWikiQueue when sent directly via POST. A patch for this issue is available in the `master` branch of CreateWiki's GitHub repository."}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}], "problemTypes": [{"descriptions": [{"cweId": "CWE-288", "description": "CWE-288: Authentication Bypass Using an Alternate Path or Channel", "lang": "en", "type": "CWE"}]}, {"descriptions": [{"cweId": "CWE-287", "description": "CWE-287: Improper Authentication", "lang": "en", "type": "CWE"}]}], "providerMetadata": {"dateUpdated": "2022-04-04T17:40:11", "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/miraheze/CreateWiki/security/advisories/GHSA-9xvw-w66v-prvg"}, {"tags": ["x_refsource_MISC"], "url": "https://github.com/miraheze/CreateWiki/commit/d0ae79843d689832ccac765d6b1721e668d99ab9"}, {"tags": ["x_refsource_MISC"], "url": "https://phabricator.miraheze.org/T9018"}], "source": {"advisory": "GHSA-9xvw-w66v-prvg", "discovery": "UNKNOWN"}, "title": "Authentication Bypass Using an Alternate Path or Channel in CreateWiki", "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "security-advisories@github.com", "ID": "CVE-2022-24813", "STATE": "PUBLIC", "TITLE": "Authentication Bypass Using an Alternate Path or Channel in CreateWiki"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "CreateWiki", "version": {"version_data": [{"version_value": "< d0ae79843d689832ccac765d6b1721e668d99ab9"}]}}]}, "vendor_name": "miraheze"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:RequestWikiQueue when sent directly via POST. A patch for this issue is available in the `master` branch of CreateWiki's GitHub repository."}]}, "impact": {"cvss": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "CWE-288: Authentication Bypass Using an Alternate Path or Channel"}]}, {"description": [{"lang": "eng", "value": "CWE-287: Improper Authentication"}]}]}, "references": {"reference_data": [{"name": "https://github.com/miraheze/CreateWiki/security/advisories/GHSA-9xvw-w66v-prvg", "refsource": "CONFIRM", "url": "https://github.com/miraheze/CreateWiki/security/advisories/GHSA-9xvw-w66v-prvg"}, {"name": "https://github.com/miraheze/CreateWiki/commit/d0ae79843d689832ccac765d6b1721e668d99ab9", "refsource": "MISC", "url": "https://github.com/miraheze/CreateWiki/commit/d0ae79843d689832ccac765d6b1721e668d99ab9"}, {"name": "https://phabricator.miraheze.org/T9018", "refsource": "MISC", "url": "https://phabricator.miraheze.org/T9018"}]}, "source": {"advisory": "GHSA-9xvw-w66v-prvg", "discovery": "UNKNOWN"}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T04:20:50.617Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/miraheze/CreateWiki/security/advisories/GHSA-9xvw-w66v-prvg"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://github.com/miraheze/CreateWiki/commit/d0ae79843d689832ccac765d6b1721e668d99ab9"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://phabricator.miraheze.org/T9018"}]}]}, "cveMetadata": {"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "assignerShortName": "GitHub_M", "cveId": "CVE-2022-24813", "datePublished": "2022-04-04T17:40:11", "dateReserved": "2022-02-10T00:00:00", "dateUpdated": "2024-08-03T04:20:50.617Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:miraheze:createwiki:*:*:*:*:*:*:*:*", "matchCriteriaId": "BEBF463E-6819-4859-872C-3C8A861AA2AD", "versionEndExcluding": "2022-04-02", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:RequestWikiQueue when sent directly via POST. A patch for this issue is available in the `master` branch of CreateWiki's GitHub repository."}, {"lang": "es", "value": "CreateWiki es la extensi\u00f3n MediaWiki de Miraheze para solicitar y crear wikis. Sin el parche para este problema, pueden hacerse comentarios an\u00f3nimos usando Special:RequestWikiQueue cuando son enviados directamente por medio de POST. Un parche para este problema est\u00e1 disponible en la rama \"master\" del repositorio GitHub de CreateWiki"}], "id": "CVE-2022-24813", "lastModified": "2024-11-21T06:51:09.340", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "security-advisories@github.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2022-04-04T18:15:07.993", "references": [{"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/miraheze/CreateWiki/commit/d0ae79843d689832ccac765d6b1721e668d99ab9"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/miraheze/CreateWiki/security/advisories/GHSA-9xvw-w66v-prvg"}, {"source": "security-advisories@github.com", "tags": ["Vendor Advisory"], "url": "https://phabricator.miraheze.org/T9018"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/miraheze/CreateWiki/commit/d0ae79843d689832ccac765d6b1721e668d99ab9"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Third Party Advisory"], "url": "https://github.com/miraheze/CreateWiki/security/advisories/GHSA-9xvw-w66v-prvg"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Vendor Advisory"], "url": "https://phabricator.miraheze.org/T9018"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-287"}, {"lang": "en", "value": "CWE-288"}], "source": "security-advisories@github.com", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-287"}], "source": "nvd@nist.gov", "type": "Primary"}]}