CVE-2024-34502: 
NixOS vulnerability analysis and mitigation

CVE-2024-34502 affects WikibaseLexeme in MediaWiki versions before 1.39.6, 1.40.x before 1.40.2, and 1.41.x before 1.41.1. The vulnerability involves the Special:MergeLexemes functionality, which attempts to make edit merges from one ID to another without proper request validation (NVD).

The vulnerability is classified as a Cross-Site Request Forgery (CSRF) issue. When loading Special:MergeLexemes, the system will attempt to merge the from-id to the to-id even if the request was not a POST request and lacks an edit token. The CVSS v3.1 base score is 9.8 (CRITICAL) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (NVD).

The vulnerability could allow unauthorized merging of lexemes in MediaWiki installations, potentially leading to data manipulation and integrity issues. The high CVSS score indicates severe potential impact on confidentiality, integrity, and availability of the affected systems (NVD).

Users should upgrade to MediaWiki versions 1.39.6, 1.40.2, or 1.41.1 or later, depending on their current version track. These versions include fixes for the vulnerability (NVD).