CVE-2024-47841

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in The Wikimedia Foundation Mediawiki - CSS Extension allows Path Traversal.This issue affects Mediawiki - CSS Extension: from 1.42.X before 1.42.2, from 1.41.X before 1.41.3, from 1.39.X before 1.39.9.
Path Traversal
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
7.5 HIGH
NETWORK
LOW
NONE
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
wikimedia-foundationCNA
---
---
CISA-ADPADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 23%
VendorProductVersion
wikimediamediawiki-extensions-css
1.42.2 <
𝑥
< 1.42.2
wikimediamediawiki-extensions-css
1.41.3 <
𝑥
< 1.41.3
wikimediamediawiki-extensions-css
1.39.9 <
𝑥
< 1.39.9
wikimediawikimedia-extensions-css
1.39.0 ≤
𝑥
< 1.39.9
wikimediawikimedia-extensions-css
1.41.0 ≤
𝑥
< 1.41.3
wikimediawikimedia-extensions-css
1.42.0 ≤
𝑥
< 1.42.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://gerrit.wikimedia.org/r/q/I46613d8d50fc978bdac58e2b312ee03324c1edc8
https://phabricator.wikimedia.org/T368628
https://phabricator.wikimedia.org/T369486