Back to Database
Status published
Medium
CVE-2024-29883
CreateWiki's wiki request suppression ignores the suppression settings set by the suppressor
Vulnerability Description
CreateWiki is Miraheze's MediaWiki extension for requesting & creating wikis. Suppression of wiki requests does not work as intended, and always restricts visibility to those with the `(createwiki)` user right regardless of the settings one sets on a given wiki request. This may expose information to users who are not supposed to be able to access it.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
THREAT MONITOR
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-29883
Credits & Attribution
No credits recorded in the NVD database.
References
More from miraheze
View All →CVE-2025-53371
DiscordNotifications allows DOS, SSRF, and possible RCE through requests to user-controlled URLs
Critical
9.1
CVE-2025-43861
ManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflection
Medium
4.4
CVE-2025-32964
ManageWiki vulnerable to permission bypass when disabling extensions requiring certain permissions in Special:ManageWiki/extensions
Medium
4.6
CVE-2025-32956
ManageWiki has SQL injection vulnerability in NamespaceMigrationJob
High
8
CVE-2024-47816
Users can impersonate import requesters if their actor IDs coincide in ImportDump
Medium
6.4
Affected Vendor
miraheze
View all reports →Affected Software
CreateWiki
Vulnerable Versions:
< 0c7c4f93834349be8f5c2a678e9a85b4b1aa7bab
Timeline
Official Publish:
March 26th, 2024
Last Modified:
August 2nd, 2024
Added to House:
July 22nd, 2026
CVSS Vectors
V3:
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N