High WID-SEC-2025-2381 4 CVEs

MediaWiki: Mehrere Schwachstellen

Published Oct 21, 2025 · Updated Oct 22, 2025 · Revision 2 · de-DE

Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in MediaWiki Extensions ausnutzen, um seine Privilegien zu erhöhen, Sicherheitsmaßnahmen zu umgehen und Cross-Site-Scripting-Angriffe durchzuführen.

Product

MediaWiki ist ein freies Wiki, das ursprünglich für den Einsatz auf Wikipedia entwickelt wurde.

Vulnerabilities 4

Critical 10.0

CVE-2025-12004

The compare API module breaks Extension:Lockdown

Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in Mediawiki Core Action APIThis issue affects Mediawiki - Lockdown Extension: from master before 1.42.

The Wikimedia Foundation Mediawiki - Lockdown Extension mediawiki Web / CMS Ubuntu

Oct 21, 2025
Medium 6.9

CVE-2025-62661

Do permission checking when getting counts of global and local edits, new articles and thanks

Incorrect Default Permissions vulnerability in The Wikimedia Foundation Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects Mediawiki - Thanks Extension, Med…

The Wikimedia Foundation Mediawiki - Thanks Extension, Mediawiki - Growth Experiments Extension Web / CMS

Oct 21, 2025
Medium 6.9

CVE-2025-62701

Stored XSS through system messages

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - Wikistories allows Stored XSS.This issue affects Mediawiki - Wikistories: from master before 1.44.

The Wikimedia Foundation Mediawiki - Wikistories mediawiki Web / CMS Ubuntu

Oct 21, 2025
Medium 6.9

CVE-2025-62702

Stored XSS through system messages

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in The Wikimedia Foundation Mediawiki - PageTriage Extension allows Stored XSS.This issue affects Mediawiki - PageTriage Extension: from master before 1.…

The Wikimedia Foundation MediaWiki PageTriage extension mediawiki Web / CMS Ubuntu

Oct 21, 2025

Revision history

2025-10-22 #2
Neue Updates aufgenommen
2025-10-21 #1
Initiale Fassung

References

NIST Vulnerability Database vom 2025-10-21
https://nvd.nist.gov/vuln/detail/CVE-2025-12004
NIST Vulnerability Database vom 2025-10-21
https://nvd.nist.gov/vuln/detail/CVE-2025-62661
NIST Vulnerability Database vom 2025-10-21
https://nvd.nist.gov/vuln/detail/CVE-2025-62701
NIST Vulnerability Database vom 2025-10-21
https://nvd.nist.gov/vuln/detail/CVE-2025-62702
MediaWiki Extensions and Skins Security Release Supplement (1.39.14/1.43.4/1.44.1)
https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/4P2UZCT4UFX2JKILESDBKT3QQ3JHMWTN/