CVE-2024-47816

ImportDump is a mediawiki extension designed to automate user import requests. A user's local actor ID is stored in the database to tell who made what requests. Therefore, if a user on another wiki happens to have the same actor ID as someone on the central wiki, the user on the other wiki can act as if they're the original wiki requester. This can be abused to create new comments, edit the request, and view the request if it's marked private. This issue has been addressed in commit `5c91dfc` and all users are advised to update. Users unable to update may disable the special page outside of their global wiki. See `miraheze/mw-config@e566499` for details on that.

• CWE-282

• https://github.com/miraheze/ImportDump/commit/5c91dfce78320e717516ee65ef5a05f01979ee6c
• https://github.com/miraheze/ImportDump/security/advisories/GHSA-jjmq-mg36-6387
• https://github.com/miraheze/mw-config/commit/e5664995fbb8644f9a80b450b4326194f20f9ddc
• https://issue-tracker.miraheze.org/T12701

Published

Oct 9, 2024

Last Modified

Jun 17, 2026

Status

Deferred

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-4781A denial-of-service vulnerability was reported in some Lenov…6.5
• CVE-2024-47810A use-after-free vulnerability exists in the way Foxit Reade…8.8
• CVE-2024-47812ImportDump is an extension for mediawiki designed to automat…6
• CVE-2024-47813Wasmtime is an open source runtime for WebAssembly. Under ce…2.9
• CVE-2024-47814Vim is an open source, command line text editor. A use-after…4.7
• CVE-2024-47815IncidentReporting is a MediaWiki extension for moving incide…6
• CVE-2024-47817Lara-zeus Dynamic Dashboard simple way to manage widgets for…6.1
• CVE-2024-47818Saltcorn is an extensible, open source, no-code database app…6.5
• CVE-2024-47819Umbraco, a free and open source .NET content management syst…8.7
• CVE-2024-4782A denial-of-service vulnerability was reported in some Lenov…6.5
• CVE-2024-47820MarkUs, a web application for the submission and grading of …3.5
• CVE-2024-47821pyLoad is a free and open-source Download Manager. The folde…2.3