CVE-2024-47536 - CVE House

Back to Database

Status published Medium CVE-2024-47536

starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field

4.8 CVSS

Vulnerability Description

Citizen is a MediaWiki skin that makes extensions part of the cohesive experience. A user with the editmyprivateinfo right or who can otherwise change their name can XSS themselves by setting their "real name" to an XSS payload. This vulnerability is fixed in 2.31.0.

Impact Analysis

Refer to official advisory for detailed impact metrics.

Remediation

Ensure systems are updated to the latest vendor-supplied patch levels.

THREAT MONITOR

Am I Vulnerable?

Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2024-47536

Check My Exposure

Credits & Attribution

No credits recorded in the NVD database.

References

More from StarCitizenTools

View All →

Citizen vulnerable to stored XSS in sticky header button messages

Citizen stored XSS vulnerability through short descriptions

Citizen Short Description stored XSS vulnerability through wikitext

Citizen is vulnerable to stored XSS attack in the legacy search bar

TabberNeue vulnerable to Stored XSS through wikitext

Affected Vendor

StarCitizenTools

View all reports →

Affected Software

mediawiki-skins-Citizen

Vulnerable Versions:

>= 2.6.3, < 2.31.0

Timeline

Official Publish: September 30th, 2024

Last Modified: September 30th, 2024

Added to House: July 22nd, 2026

CVSS Vectors

Weaknesses (CWE)

MITRE ATT&CK TTPs

T1189 Drive-by Compromise

T1059 Command and Scripting Interpreter

T1552 Unsecured Credentials

Credential Access

T1071 Application Layer Protocol

Command and Control

T1565 Data Manipulation

T1059.007 JavaScript

T1539 Steal Web Session Cookie

T1213 Data from Information Repositories

T1567 Exfiltration Over Web Service

T1491.001 Defacement