CVE-2024-47815
Cross-site Scripting in IncidentReporting
IncidentReporting is a MediaWiki extension for moving incident reports from wikitext to database tables. There are a variety of Cross-site Scripting issues, though all of them require elevated permissions. Some are available to anyone who has the editincidents right, some are available to those who can edit interface messages (typically administrators and interface admins), and one is available to those who can edit LocalSettings.php. These issues have been addressed in commit 43896a4 and all users are advised to upgrade. Users unable to upgrade should prevent access to the Special:IncidentReports page.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- High
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
Cross-site Scripting in IncidentReporting
IncidentReporting is a MediaWiki extension for moving incident reports from wikitext to database tables. There are a variety of Cross-site Scripting issues, though all of them require elevated permissions. Some are available to anyone who has the editincidents right, some are available to those who can edit interface messages (typically administrators and interface admins), and one is available to those who can edit LocalSettings.php. These issues have been addressed in commit 43896a4 and all users are advised to upgrade. Users unable to upgrade should prevent access to the Special:IncidentReports page.
- Record
CVE-2024-47815- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
EUVDEUVD-2024-42698
IncidentReporting is a MediaWiki extension for moving incident reports from wikitext to database tables. There are a variety of Cross-site Scripting issues, though all of them require elevated permissions. Some are available to anyone who has the editincidents right, some are available to those who can edit interface messages (typically administrators and interface admins), and one is available to those who can edit LocalSettings.php. These issues have been addressed in commit 43896a4 and all users are advised to upgrade. Users unable to upgrade should prevent access to the Special:IncidentReports page.
- Record
EUVD-2024-42698- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L - Updated
- 2026-11-03
NVD
IncidentReporting is a MediaWiki extension for moving incident reports from wikitext to database tables. There are a variety of Cross-site Scripting issues, though all of them require elevated permissions. Some are available to anyone who has the editincidents right, some are available to those who can edit interface messages (typically administrators and interface admins), and one is available to those who can edit LocalSettings.php. These issues have been addressed in commit 43896a4 and all users are advised to upgrade. Users unable to upgrade should prevent access to the Special:IncidentReports page.
- Record
CVE-2024-47815- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
OSV
Cross-site Scripting in IncidentReporting
IncidentReporting is a MediaWiki extension for moving incident reports from wikitext to database tables. There are a variety of Cross-site Scripting issues, though all of them require elevated permissions. Some are available to anyone who has the editincidents right, some are available to those who can edit interface messages (typically administrators and interface admins), and one is available to those who can edit LocalSettings.php. These issues have been addressed in commit 43896a4 and all users are advised to upgrade. Users unable to upgrade should prevent access to the Special:IncidentReports page.
- Record
CVE-2024-47815- CVSS 3.1
- 6.0 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:L/I:H/A:L - Weakness
- CWE-79, CWE-80
- Updated
- 2026-11-02
Affected products
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, published | EUVD | |
| first indexed | CVE List, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2024-47815 is a medium vulnerability (CVSS 6.0) in Miraheze Incidentreporting, published October 9, 2024. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.42%, the 36th percentile. No source names a fixed version.
References
github.com/miraheze/IncidentReporting/security/advisories/GHSA-9p36-hrmr-98r9
issue-tracker.miraheze.org/T12702
nvd.nist.gov/vuln/detail/CVE-2024-47815