CVE-2024-34701

CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users to be considered as the requester of a specific wiki request if their local user ID on any wiki in a wiki farm matches the local ID of the requester at the wiki where the wiki request was made. This allows them to go to that request entry's on Special:RequestWikiQueue on the wiki where their local user ID matches and take any actions that the wiki requester is allowed to take from there. Commit 02e0f298f8d35155c39aa74193cb7b867432c5b8 fixes the issue. Important note about the fix: This vulnerability has been fixed by disabling access to the REST API and special pages outside of the wiki configured as the "global wiki" in `$wgCreateWikiGlobalWiki` in a user's MediaWiki settings. As a workaround, it is possible to disable the special pages outside of one's own global wiki by doing something similar to `miraheze/mw-config` commit e5664995fbb8644f9a80b450b4326194f20f9ddc that is adapted to one's own setup. As for the REST API, before the fix, there wasn't any REST endpoint that allowed one to make writes. Regardless, it is possible to also disable it outside of the global wiki by using `$wgCreateWikiDisableRESTAPI` and `$wgConf` in the configuration for one's own wiki farm..

• CWE-863

• https://github.com/miraheze/CreateWiki/commit/02e0f298f8d35155c39aa74193cb7b867432c5b8
• https://github.com/miraheze/CreateWiki/security/advisories/GHSA-89fx-77w7-rc64
• https://github.com/miraheze/mw-config/commit/1798e53901a202b62edab32f8bcd5c6b9e574191
• https://github.com/miraheze/mw-config/commit/e5664995fbb8644f9a80b450b4326194f20f9ddc
• https://issue-tracker.miraheze.org/T12011
• https://issue-tracker.miraheze.org/T12102
• https://github.com/miraheze/CreateWiki/commit/02e0f298f8d35155c39aa74193cb7b867432c5b8
• https://github.com/miraheze/CreateWiki/security/advisories/GHSA-89fx-77w7-rc64
• https://github.com/miraheze/mw-config/commit/1798e53901a202b62edab32f8bcd5c6b9e574191
• https://github.com/miraheze/mw-config/commit/e5664995fbb8644f9a80b450b4326194f20f9ddc
• https://issue-tracker.miraheze.org/T12011
• https://issue-tracker.miraheze.org/T12102

Published

May 14, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-34695WOWS Karma is a reputation system for Wargaming's World of W…6.3
• CVE-2024-34696GeoServer is an open source server that allows users to shar…4.9
• CVE-2024-34697FreeScout is a free, self-hosted help desk and shared mailbo…6.1
• CVE-2024-34698FreeScout is a free, self-hosted help desk and shared mailbo…6.3
• CVE-2024-34699GZ::CTF is a capture the flag platform. Prior to 0.20.1, unp…6.5
• CVE-2024-3470An Improper Privilege Management vulnerability was identifie…7.2
• CVE-2024-34702Botan is a C++ cryptography library. X.509 certificates can …5.3
• CVE-2024-34703Botan is a C++ cryptography library. X.509 certificates can …7.5
• CVE-2024-34704era-compiler-solidity is the ZKsync compiler for Solidity. …5.9
• CVE-2024-34706Valtimo is an open source business process and case manageme…9.8
• CVE-2024-34707Nautobot is a Network Source of Truth and Network Automation…4.8
• CVE-2024-34708Directus is a real-time API and App dashboard for managing S…4.9