CVE-2024-47812

ImportDump is an extension for mediawiki designed to automate user import requests. Anyone who can edit the interface strings of a wiki (typically administrators and interface admins) can embed XSS payloads in the messages for dates, and thus XSS anyone who views Special:RequestImportQueue. This issue has been patched in commit `d054b95` and all users are advised to apply this commit to their branch. Users unable to upgrade may either Prevent access to Special:RequestImportQueue on all wikis, except for the global wiki; and If an interface administrator (or equivalent) level protection is available (which is not provided by default) on the global wiki, protect the affected messages up to that level. This causes the XSS to be virtually useless as users with those rights can already edit Javascript pages. Or Prevent access to Special:RequestImportQueue altogether.

• CWE-79
• CWE-80

• https://github.com/miraheze/ImportDump/commit/d054b9529129af79d4426df24faa80014cb16602
• https://github.com/miraheze/ImportDump/security/advisories/GHSA-465h-45v4-6fx9
• https://issue-tracker.miraheze.org/T12698

Published

Oct 9, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-47806Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a…8.1
• CVE-2024-47807Jenkins OpenId Connect Authentication Plugin 4.354.v321ce67a…8.1
• CVE-2024-47808A vulnerability has been identified in SINEC NMS (All versio…6.5
• CVE-2024-47809In the Linux kernel, the following vulnerability has been re…5.5
• CVE-2024-4781A denial-of-service vulnerability was reported in some Lenov…6.5
• CVE-2024-47810A use-after-free vulnerability exists in the way Foxit Reade…8.8
• CVE-2024-47813Wasmtime is an open source runtime for WebAssembly. Under ce…2.9
• CVE-2024-47814Vim is an open source, command line text editor. A use-after…4.7
• CVE-2024-47815IncidentReporting is a MediaWiki extension for moving incide…6
• CVE-2024-47816ImportDump is a mediawiki extension designed to automate use…6.4
• CVE-2024-47817Lara-zeus Dynamic Dashboard simple way to manage widgets for…6.1
• CVE-2024-47818Saltcorn is an extensible, open source, no-code database app…6.5