High WID-SEC-2025-0790 14 CVEs

MediaWiki Erweiterungen und -Komponenten: Mehrere Schwachstellen

Published Apr 13, 2025 · Updated Jul 23, 2025 · Revision 3 · de-DE

Vendor: Debian Product: Linux Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in verschiedenen MediaWiki Erweiterungen und -Komponenten ausnutzen, um Cross Site Scripting Angriffe durchzuführen, beliebigen Code auszuführen, Informationen offenzulegen und Sicherheitsmaßnahmen wie z.B. die Authentisierung zu umgehen.

Product

MediaWiki ist ein freies Wiki, das ursprünglich für den Einsatz auf Wikipedia entwickelt wurde.

Vulnerabilities 14

Medium 6.9

CVE-2025-32072

HTML injection in feed output from i18n message

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki Core - Feed Utils allows WebView Injection.This issue affects Mediawiki Core - Feed Utils: from 1.39 through 1.43.

The Wikimedia Foundation Mediawiki Core - Feed Utils mediawiki mediawiki Web / CMS Debian Ubuntu

Apr 11, 2025
Medium 6.9

CVE-2025-32075

IP and user agent leaks in Extension:Tabs

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Tabs Extension allows Code Injection.This issue affects Mediawiki - Tabs Extension: from 1.39 through 1.43.

The Wikimedia Foundation Mediawiki - Tabs Extension Web / CMS

Apr 11, 2025
Medium 6.9

CVE-2025-32076

Evil regex used to process user-provided data in VisualData

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Visual Data Extension allows HTTP DoS.This issue affects Mediawiki - Visual Data Extension: from 1.39 through 1.43.

The Wikimedia Foundation Mediawiki - Visual Data Extension Web / CMS

Apr 11, 2025
Medium 6.9

CVE-2025-32077

XSSes in Extension:SimpleCalendar

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Extension:SimpleCalendar allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Extension:SimpleCalendar: from 1.39 through 1.43.

The Wikimedia Foundation Mediawiki - Extension:SimpleCalendar Web / CMS

Apr 11, 2025
Medium 6.9

CVE-2025-32078

XSSes and potential RCE in Special:VersionCompare

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Version Compare Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Version Compare Extension: from 1.39 through 1.43.

The Wikimedia Foundation Mediawiki - Version Compare Extension Web / CMS

Apr 11, 2025
Medium 6.9

CVE-2025-32080

Cross-origin data leak in mobilefrontend via lazy load images

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in The Wikimedia Foundation Mediawiki - Mobile Frontend Extension allows Shared Resource Manipulation.This issue affects Mediawiki - Mobile Frontend Extension: from 1.39 through 1.43.

The Wikimedia Foundation Mediawiki - Mobile Frontend Extension Web / CMS

Apr 11, 2025
Medium 6.5

CVE-2025-32079

Saving the right content to MediaWiki:GrowthMentors.json can take down the site

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - GrowthExperiments allows HTTP DoS.This issue affects Mediawiki - GrowthExperiments: from 1.39 through 1.43.

The Wikimedia Foundation Mediawiki - GrowthExperiments Web / CMS

Apr 11, 2025
Medium 5.4

CVE-2025-32067

i18n XSS vulnerability in message growthexperiments

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Growth Experiments Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Growth Experiments Extension: from 1.39 through 1.43.

The Wikimedia Foundation Mediawiki - Growth Experiments Extension Web / CMS

Apr 11, 2025
Medium 5.4

CVE-2025-32068

Revoking authorization of OAuth2 consumer does not invalidate refresh tokens

Incorrect Authorization vulnerability in The Wikimedia Foundation Mediawiki - OAuth Extension allows Authentication Bypass.This issue affects Mediawiki - OAuth Extension: from 1.39 through 1.43.

The Wikimedia Foundation Mediawiki - OAuth Extension Web / CMS

Apr 11, 2025
Medium 5.4

CVE-2025-32069

Wikitext stored XSS on filepages due to dangerous WBMI serialization

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikibase Media Info Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Wikibase Media Info Extension: from 1.39 through 1.43.

The Wikimedia Foundation Mediawiki - Wikibase Media Info Extension Web / CMS

Apr 11, 2025
Medium 5.4

CVE-2025-32070

XSSes in AJAXPoll

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - AJAX Poll Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - AJAX Poll Extension: from 1.39 through 1.43.

The Wikimedia Foundation Mediawiki - AJAX Poll Extension Web / CMS

Apr 11, 2025
Medium 5.4

CVE-2025-32071

Wikibase CommonsInlineImageFormatter: i18n XSS

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - Wikidata Extension allows Cross-Site Scripting (XSS) from widthheight message via ImageHandler::getDimensionsString()This issue affects Mediawiki - Wikidata Extension: from 1.39 t…

The Wikimedia Foundation Mediawiki - Wikidata Extension Web / CMS

Apr 11, 2025
Medium 5.4

CVE-2025-32073

System message XSS in HTMLTags

Improper Input Validation vulnerability in The Wikimedia Foundation Mediawiki - HTML Tags allows Cross-Site Scripting (XSS).This issue affects Mediawiki - HTML Tags: from 1.39 through 1.43.

The Wikimedia Foundation Mediawiki - HTML Tags Web / CMS

Apr 11, 2025
Medium 5.4

CVE-2025-32074

XSSes in Extension:ConfirmAccount

Improper Encoding or Escaping of Output vulnerability in The Wikimedia Foundation Mediawiki - Confirm Account Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - Confirm Account Extension: from 1.39 through 1.43.

The Wikimedia Foundation Mediawiki - Confirm Account Extension Web / CMS

Apr 11, 2025

Revision history

2025-07-23 #3
Neue Updates von Debian aufgenommen
2025-07-03 #2
Neue Updates von Debian aufgenommen
2025-04-13 #1
Initiale Fassung

References

MediaWiki Extensions and Skins Security Release Supplement vom 2025-04-13
https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/OXIGQIHBL26HFKG6TT5SWSH7K7W6RO4H/
Debian Security Advisory DSA-5957 vom 2025-07-03
https://lists.debian.org/debian-security-announce/2025/msg00121.html
Debian Security Advisory DLA-4249 vom 2025-07-23
https://lists.debian.org/debian-lts-announce/2025/07/msg00012.html