CVE-2024-47536
starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. This vulnerability is fixed in 2.31.0.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- Active
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. This vulnerability is fixed in 2.31.0.
- Record
CVE-2024-47536- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-80, CWE-79
- Updated
- 2026-11-02
EUVDEUVD-2024-2724
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. This vulnerability is fixed in 2.31.0.
- Record
EUVD-2024-2724- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-62r2-gcxr-426x
starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field
Summary
A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload.
Details
Here's the offending line: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/d45c3d69f30863f622f16eb40dd41d3ca943454a/includes/Components/CitizenComponentUserInfo.php#L137
This was introduced in 717d16af35b10dab04d434aefddbf991fc8c168c
PoC
- Login
- Go to Special:Preferences
- Set the real name field to a string like
<script>alert("Admin with a propensity for self-XSSes")</script> - Save your settings and use Citizen if it's not being used already
Impact
Any user who can change their name (whether it's through the editmyprivateinfo right or through other means) can add XSS payloads that trigger for themselves only.
- Record
GHSA-62r2-gcxr-426x- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
NVD
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. This vulnerability is fixed in 2.31.0.
- Record
CVE-2024-47536- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X - CVSS 3.1
- 5.4 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
OSV
starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field
Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. This vulnerability is fixed in 2.31.0.
- Record
CVE-2024-47536- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
OSVGHSA-62r2-gcxr-426x
starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field
Summary
A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload.
Details
Here's the offending line: https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/d45c3d69f30863f622f16eb40dd41d3ca943454a/includes/Components/CitizenComponentUserInfo.php#L137
This was introduced in 717d16af35b10dab04d434aefddbf991fc8c168c
PoC
- Login
- Go to Special:Preferences
- Set the real name field to a string like
<script>alert("Admin with a propensity for self-XSSes")</script> - Save your settings and use Citizen if it's not being used already
Impact
Any user who can change their name (whether it's through the editmyprivateinfo right or through other means) can add XSS payloads that trigger for themselves only.
- Record
GHSA-62r2-gcxr-426x- CVSS 4.0
- 4.8 Medium
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N - CVSS 3.1
- 4.6 Medium
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
starcitizentools/citizen-skinPackagist |
2.6.3 up to 2.31.0 | 2.31.0 |
starcitizentools/citizen-skinPackagist |
2.6.3 up to 2.31.0, plus listed versions v2.10.0v2.10.1v2.11.0v2.11.1v2.12.0 Show 45 moreShow lessv2.13.0v2.13.1v2.13.2v2.13.3v2.13.4v2.13.5v2.14.0v2.14.1v2.15.0v2.15.1v2.16.0v2.16.1v2.17.0v2.17.1v2.17.2v2.18.0v2.18.1v2.19.0v2.20.0v2.21.0v2.22.0v2.22.1v2.23.0v2.24.0v2.25.0v2.26.0v2.27.0v2.28.0v2.29.0v2.30.0v2.6.3v2.6.4v2.6.5v2.6.6v2.7.0v2.7.1v2.7.10v2.7.11v2.7.2v2.7.3v2.7.4v2.7.5v2.7.6v2.7.7v2.7.8 |
2.31.0 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-47536 is a medium vulnerability (CVSS 4.8) in Starcitizen.tools Citizen, published September 30, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.46%, the 40th percentile. Fixed in starcitizentools/citizen-skin 2.31.0.
References
github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-62r2-gcxr-426x
nvd.nist.gov/vuln/detail/CVE-2024-47536
Left out here: 9 versions. The JSON record has them.