Skip to main content

Cargo CVE-2024-47846

MEDIUM
Cross-Site Request Forgery (CSRF) (CWE-352)
2024-10-05 c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
CSRF Cargo
6.9
CVSS 4.0 · Vendor: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc
Share

Severity by source

Vendor (c4f26cc8-17ff-4c99-b5e2-38fc1793eacc) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Primary rating from Vendor (c4f26cc8-17ff-4c99-b5e2-38fc1793eacc) · only source for this CVE.

CVSS VectorVendor: c4f26cc8-17ff-4c99-b5e2-38fc1793eacc

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

1
CVE Published
Oct 05, 2024 - 01:15 cve.org
MEDIUM 6.9

DescriptionCVE.org

Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.This issue affects Mediawiki - Cargo: from 3.6.X before 3.6.1.

AnalysisAI

Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.6.X before 3.6.1. Rated medium severity (CVSS 6.9), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available.

Technical ContextAI

This vulnerability is classified as Cross-Site Request Forgery (CSRF) (CWE-352), which allows attackers to trick authenticated users into performing unintended actions. Cross-Site Request Forgery (CSRF) vulnerability in The Wikimedia Foundation Mediawiki - Cargo allows Cross Site Request Forgery.6.X before 3.6.1. Affected products include: Mediawiki Cargo. Version information: before 3.6.1..

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Implement anti-CSRF tokens, validate Origin/Referer headers, use SameSite cookie attribute.

More in Cargo

View all
CVE-2024-47849 HIGH POC
8.8 Oct 05

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in The Wikimedia Foun
CVE-2024-47847 MEDIUM POC
6.9 Oct 05

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimed
CVE-2022-36113 HIGH
8.1 Sep 14

Cargo is a package manager for the rust programming language. Rated high severity (CVSS 8.1), this vulnerability is remo
CVE-2023-38497 HIGH
7.3 Aug 04

Cargo downloads the Rust project’s dependencies and compiles the project. Rated high severity (CVSS 7.3), this vulnerabi
CVE-2026-5223 MEDIUM
6.5 May 25

Tarball unpacking in Rust's Cargo package manager fails to reject symlinks within downloaded crate archives, enabling a

CVE-2022-36114 MEDIUM
6.5 Sep 14

Cargo is a package manager for the rust programming language. Rated medium severity (CVSS 6.5), this vulnerability is re
CVE-2026-5222 LOW
2.3 May 25

Credential leakage in Cargo's sparse index registry URL normalization affects all Cargo releases from 1.68 through 1.96.

Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2013-5696 MEDIUM POC
6.8
CVE-2020-36836 HIGH POC
8.0
CVE-2015-2295 MEDIUM POC
6.8
CVE-2016-6897 MEDIUM POC
6.5
CVE-2022-41622 HIGH POC
8.8
CVE-2025-2907 CRITICAL POC
9.8

Same technique CSRF

View all
CVE-2016-6277 HIGH POC
8.8
CVE-2014-100005 HIGH POC
8.0
CVE-2017-9757 HIGH POC
8.8
CVE-2013-5696 MEDIUM POC
6.8
CVE-2013-4152 MEDIUM POC
6.8
CVE-2024-7094 CRITICAL
9.8
CVE-2015-4624 HIGH POC
7.5
CVE-2020-36836 HIGH POC
8.0

Share

CVE-2024-47846 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy