Skip to content
OpenAdvisories
Medium WID-SEC-2025-0098 7 CVEs

MediaWiki: Mehrere Schwachstellen

Published Jan 14, 2025 · Updated Jan 14, 2025 · de-DE

Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, um Dateien zu manipulieren oder vertrauliche Informationen offenzulegen.

Product

MediaWiki ist ein freies Wiki, das ursprünglich für den Einsatz auf Wikipedia entwickelt wurde.

Vulnerabilities 7

  • Medium 6.5
    CVE-2025-23078

    XSS in BreadCrumbs2

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - Breadcrumbs2 extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Breadcrumbs2 extension: from …

    Wikimedia Foundation Mediawiki - Breadcrumbs2 extension Web / CMS
  • Medium 6.1
    CVE-2025-23079

    XSSes in Extension:ArticleFeedbackv5

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - ArticleFeedbackv5 extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - ArticleFeedbackv5 extens…

    Wikimedia Foundation Mediawiki - ArticleFeedbackv5 extension Web / CMS
  • Medium 6.1
    CVE-2025-23081

    Various security vulnerabilities in Extension:DataTransfer

    Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XS…

    Wikimedia Foundation Mediawiki - DataTransfer Extension mediawiki/data-transfer Web / CMS Packagist
  • Medium 5.4
    CVE-2025-23072

    XSS in Special:RefreshSpecial

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - RefreshSpecial Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - RefreshSpecial Extension: f…

    Wikimedia Foundation Mediawiki - RefreshSpecial Extension Web / CMS
  • Medium 5.3
    CVE-2025-23080

    XSSes in Special:BadgeView

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - OpenBadges Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - OpenBadges Extension: from 1.39…

    Wikimedia Foundation Mediawiki - OpenBadges Extension Web / CMS
  • Low 3.5
    CVE-2025-23073

    API list=globalblocks can reveal IP of autoblock if username and IP are included in the bgtargets parameter

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - GlobalBlocking Extension allows Retrieve Embedded Sensitive Data. This issue briefly impacted the master branch of MediaWiki’s GlobalBlocking Extensio…

    Wikimedia Foundation Mediawiki - GlobalBlocking Extension Web / CMS
  • Low 2.4
    CVE-2025-23074

    Special:EditProfile exposes the contents of profile fields marked "hidden"/friends or "friends of friends" when the privileged user isn't a friend of the user whose profile they edit(ed)

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - SocialProfile Extension allows Functionality Misuse.This issue affects Mediawiki - SocialProfile Extension: from 1.39.X before 1.39.11, from 1.41.X be…

    Wikimedia Foundation Mediawiki - SocialProfile Extension Web / CMS

Revision history

  1. #1

    Initiale Fassung

References