{"id":"CVE-2024-34502","aliases":["BIT-mediawiki-2024-34502","EUVD-2024-34831","GHSA-rq44-cfp6-2c3c"],"status":"published","title":"An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1...","description":"An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attempt to) make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit token.","severity":{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-11","score":0.00409,"percentile":0.35648,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-352"],"published":"2024-05-05T00:00:00Z","modified":"2026-10-28T02:30:49Z","fixes":[{"ecosystem":"Bitnami","package":"mediawiki","fixed_in":["1.41.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"mediawiki","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.41.1"}]}]}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"https://phabricator.wikimedia.org/T357101","tags":["x_transferred","Issue Tracking","Vendor Advisory","web"]},{"url":"https://gerrit.wikimedia.org/r/c/mediawiki/extensions/WikibaseLexeme/+/1013359","tags":["x_transferred","Patch","Vendor Advisory","web"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/","tags":["vendor-advisory","x_transferred","Mailing List","Third Party Advisory","web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY/","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-34502","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY"},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY"},{"url":"https://github.com/advisories/GHSA-rq44-cfp6-2c3c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34502.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-34502","description":"An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attempt to) make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit token.","status":"published","published":"2024-05-05T00:00:00Z","modified":"2025-11-04T17:20:46.748Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"adp"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:34:23.516065Z"}],"euvd":[{"id":"EUVD-2024-34831","description":"An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attempt to) make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit token.","status":"published","published":"2024-05-05T00:00:00Z","modified":"2025-11-04T17:20:46Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T19:49:25.004858Z"}],"ghsa":[{"id":"GHSA-rq44-cfp6-2c3c","title":"An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1...","description":"An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attempt to) make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit token.","status":"published","published":"2024-05-05T21:30:30Z","modified":"2025-11-04T18:30:56Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T15:04:33.412684Z"}],"nvd":[{"id":"CVE-2024-34502","description":"An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attempt to) make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit token.","status":"published","published":"2024-05-05T19:15:07.197Z","modified":"2026-06-17T07:33:31.943Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"secondary"}],"cwes":["CWE-352"],"updated_at":"2026-11-02T14:09:56.122111Z"}],"osv":[{"id":"CVE-2024-34502","description":"An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attempt to) make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit token.","status":"published","published":"2024-05-05T00:00:00Z","modified":"2026-10-28T02:30:49.774161801Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:40.391953Z"},{"id":"BIT-mediawiki-2024-34502","description":"An issue was discovered in WikibaseLexeme in MediaWiki before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. Loading Special:MergeLexemes will (attempt to) make an edit that merges the from-id to the to-id, even if the request was not a POST request, and even if it does not contain an edit token.","status":"published","published":"2025-06-18T14:57:43.589Z","modified":"2025-11-06T13:25:46.476Z","updated_at":"2026-11-02T15:28:33.072289Z"}]}}