Read the docs
TI-2024-32083 Aliases CVE-2024-47816

Users can impersonate import requesters if their actor IDs coincide in ImportDump

Priority LOW 28CWE-282Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
Low · High · Low
Fix status
No fix listed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA.

Summary

ImportDump is a mediawiki extension designed to automate user import requests. A user's local actor ID is stored in the database to tell who made what requests. Therefore, if a user on another wiki happens to have the same actor ID as someone on the central wiki, the user on the other wiki can act as if they're the original wiki requester. This can be abused to create new comments, edit the request, and view the request if it's marked private. This issue has been addressed in commit `5c91dfc` and all users are advised to update. Users unable to update may disable the special page outside of their global wiki. See `miraheze/mw-config@e566499` for details on that.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00334 26th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
mirahezeImportDumpcommits prior to 5c91dfc—No fix listedCNA
  • ImportDump Vendormiraheze Affected commits prior to 5c91dfc Fixed in — No fix listed CNA

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-47816

References

Other 4

  • TI-2024-16562 Cross-Site Scripting in WikiDiscover CVSS 3.1MEDIUM 6.1
  • TI-2021-10196 wikiconfig API leaked private config variables set through ManageWiki CVSS 3.1CRITICAL 9.4
  • TI-2025-33333 DiscordNotifications allows DOS, SSRF, and possible RCE through requests to user-controlled URLs CVSS 3.1CRITICAL 9.1
  • TI-2025-23966 ManageWiki has SQL injection vulnerability in NamespaceMigrationJob CVSS 3.1HIGH 8.0
  • TI-2026-23374 TSPortal: Anyone can forge self-deletion requests of any user CVSS 4.0HIGH 8.4
  • TI-2024-32057 Cross-site Scripting (XSS) in Special:WikiDiscover when displaying wiki information in WikiDiscover CVSS 3.1HIGH 7.6
See all 22 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences