CVE-2024-47913: AbuseFilter · Sensitive Data in Logs
Affects AbuseFilterSource CVE Database V5
Not known to be exploited · CVSS 5.3 Medium · fixed in 1.41.3 : update AbuseFilter when convenient.
Data as of 26 Oct 2026, 14:05 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 39% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
- Patch
- Available – fixed in 1.41.3, 1.41.0, 1.39.9
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitation evidence
Disclosed: evidence found.
CVE published 4 Oct 2024
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 26 Oct 2026.
What to do
Upgrade mediawiki/extensions/AbuseFilter to 1.41.3, 1.41.0 or 1.39.9.
Affected software
| Product | Affected | Fixed in |
|---|---|---|
GitHubmediawiki/extensions/AbuseFilterpkg:github/mediawiki/extensions/AbuseFilterOther threats | Affected
| Fixed in
|
Check your own hosts for these packages with threat-finder (opens in a new tab), our free open-source scanner.
AI-suggested
To mitigate CVE-2024-47913, organizations should upgrade the AbuseFilter extension to the fixed versions: 1.39.9 or later, 1.41.3 or later, and 1.42.2 or later, depending on their MediaWiki version branch. If immediate patching is not possible, administrators should restrict API access to trusted users only, implementing strict access controls and network-level restrictions to limit exposure. Reviewing and tightening permissions related to AbuseFilter logs and API endpoints can reduce unauthorized access risk. Monitoring API usage logs for unusual or unauthorized queries targeting AbuseFilter logs is recommended to detect potential exploitation attempts. Additionally, consider disabling or limiting AbuseFilter logging if not essential, to minimize sensitive information exposure. Regularly auditing MediaWiki extensions and applying security updates promptly will help prevent similar vulnerabilities. Finally, educating administrators about the sensitivity of log data and enforcing the principle of least privilege on API access are critical best practices.
Description
An issue was discovered in the AbuseFilter extension for MediaWiki before 1.39.9, 1.40.x and 1.41.x before 1.41.3, and 1.42.x before 1.42.2. An API caller can match a filter condition against AbuseFilter logs even if the caller is not authorized to view the log details for the filter.