Skip to content
OpenAdvisories
Medium WID-SEC-2025-0788 6 CVEs

MediaWiki: Mehrere Schwachstellen

Published Apr 10, 2025 · Updated Jul 23, 2025 · Revision 3 · de-DE

Vendor: Debian Product: Linux Platform: Linux Platform: Windows

Summary

Ein entfernter, authentisierter Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um Sicherheitsvorkehrungen zu umgehen Informationen auszuspähen, Cross-Site-Scripting durchzuführen oder nicht näher spezifizierte Auswirkungen zu verursachen.

Product

MediaWiki ist ein freies Wiki, das ursprünglich für den Einsatz auf Wikipedia entwickelt wurde.

Vulnerabilities 6

  • Low 2.3
    CVE-2025-32700

    AbuseFilter log interfaces expose global private and hidden filters when central DB is not available

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation AbuseFilter. This vulnerability is associated with program files includes/Api/QueryAbuseLog.Php, includes/Pager/AbuseLogPager.Php, includes/Special/SpecialAbuseLo…

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • Low 2.1
    CVE-2025-32698

    LogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictions

    Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/logging/LogPager.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1.

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • Low 2.1
    CVE-2025-32699

    Potential javascript injection attack enabled by Unicode normalization in Action API

    Vulnerability in Wikimedia Foundation MediaWiki, Wikimedia Foundation Parsoid.This issue affects MediaWiki: before 1.39.12, 1.42.6, 1.43.1; Parsoid: before 0.16.5, 0.19.2, 0.20.2.

    Wikimedia Foundation MediaWiki Parsoid mediawiki Web / CMS Debian Ubuntu
  • None 0.0
    CVE-2025-32696

    "reupload-own" restriction can be bypassed by reverting file

    Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/actions/RevertAction.Php, includes/api/ApiFileRevert.Php. This issue affects MediaWiki: before 1.39.12, 1.42.6, …

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • None 0.0
    CVE-2025-32697

    Cascading protection is not preventing file reversions

    Improper Preservation of Permissions vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/editpage/IntroMessageBuilder.Php, includes/Permissions/PermissionManager.Php, includes/Permissions/RestrictionSt…

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu
  • None 0.0
    CVE-2025-3469

    i18n XSS vulnerability in HTMLMultiSelectField when sections are used

    Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/htmlform/fields/HTMLMultiSelectField.Php. This issue affe…

    Wikimedia Foundation MediaWiki mediawiki mediawiki Web / CMS Debian Ubuntu

Revision history

  1. #3

    Neue Updates von Debian aufgenommen

  2. #2

    Neue Updates von Debian aufgenommen

  3. #1

    Initiale Fassung

References