CVE-2024-47536

Packagist/starcitizentools/citizen-skin CVE-2024-47536: medium 4.6

starcitizentools/citizen-skin vulnerable to stored, self-XSS in the "real name" field

Action: Upgrade starcitizentools/citizen-skin to 2.31.0 or later.

composer require starcitizentools/citizen-skin:2.31.0

Affected

Fixed versions

Sources

• osv: GHSA-62r2-gcxr-426x
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/security/advisories/GHSA-62r2-gcxr-426x
• https://nvd.nist.gov/vuln/detail/CVE-2024-47536
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/717d16af35b10dab04d434aefddbf991fc8c168c
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/commit/86da3e07718c8d8da6f4310386fef85599606f9b
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen
• https://github.com/StarCitizenTools/mediawiki-skins-Citizen/blob/d45c3d69f30863f622f16eb40dd41d3ca943454a/includes/Components/CitizenComponentUserInfo.php#L137

CVE-2024-47536 · published 2024-09-30T17:48:33Z · modified 2024-09-30T20:26:23.850872Z · JSON