Skip to content
OpenAdvisories

Product · miraheze

CreateWiki

6 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

6 results · Clear filters · Feed

  • Medium 5.3
    CVE-2024-47781

    Cross-site Scripting (XSS) in Special:RequestWikiQueue when displaying sitename in CreateWiki

    CreateWiki is an extension used at Miraheze for requesting & creating wikis. The name of requested wikis is not escaped on Special:RequestWikiQueue, so a user can insert arbitrary HTML that is displayed in the request wiki queue when requesting a wiki. If a w…

    miraheze CreateWiki
  • Medium 5.9
    CVE-2024-34701

    CreateWiki vulnerable to impersonation of wiki requester

    CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users to be considered as the requester of a specific wiki request if their local user ID on any wiki in a wiki farm matches the local ID of the requester at the …

    miraheze CreateWiki
  • Medium 4.9
    CVE-2024-29898

    Oversight in fix for GHSA-4rcf-3cj2-46mq may have exposed suppressed wiki requests on private wikis

    CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. An oversight during the writing of the patch for CVE-2024-29897 may have exposed suppressed wiki requests to private wikis that added Special:RequestWikiQueue to the read whitelist …

    miraheze CreateWiki
  • Medium 4.9
    CVE-2024-29897

    CreateWiki Leak of suppressed wiki requests outside of `CreateWikiGlobalWiki`

    CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. It is possible for users with (delete) or (suppressrevision) on any wiki in the farm to access suppressed wiki requests by going to the request's entry on Special:RequestWikiQueue o…

    miraheze CreateWiki
  • Medium 4.9
    CVE-2024-29883

    CreateWiki's wiki request suppression ignores the suppression settings set by the suppressor

    CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Suppression of wiki requests does not work as intended, and always restricts visibility to those with the `(createwiki)` user right regardless of the settings one sets on a given wi…

    miraheze CreateWiki
  • Medium 5.3
    CVE-2022-24813

    Authentication Bypass Using an Alternate Path or Channel in CreateWiki

    CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Without the patch for this issue, anonymous comments can be made using Special:RequestWikiQueue when sent directly via POST. A patch for this issue is available in the `master` bran…

    miraheze CreateWiki