Summary
Ein Angreifer kann mehrere Schwachstellen in MediaWiki ausnutzen, um Informationen offenzulegen, um einen Denial of Service Angriff durchzuführen, und um Sicherheitsvorkehrungen zu umgehen.
Product
MediaWiki ist ein freies Wiki, das ursprünglich für den Einsatz auf Wikipedia entwickelt wurde.
Vulnerabilities 11
-
Medium 5.5
User localization leaked by AbuseFilter + EventStream
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
-
Medium 5.1
Users API leaks whether privileged users have their user groups disabled for lack of 2FA
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation OATHAuth. This issue affects OATHAuth: from * before 1.43.7, 1.44.4, 1.45.2.
-
Medium 4.8
Suggested investigations: Handle suppressed usernames
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation CheckUser. This issue affects CheckUser: from 1.45.0 before 1.45.2.
-
Low 2.3
Memory leak in Scribunto causes runJobs.php to run out of memory
Vulnerability in Wikimedia Foundation Scribunto. This issue affects Scribunto: from 1.45.0 before 1.45.2.
-
Low 2.3
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Echo. This vulnerabili…
-
Low 2.1
AbuseFilter misuses ::userCanBitfield, exposing access-controlled information
Vulnerability in Wikimedia Foundation AbuseFilter. This issue affects AbuseFilter: from * before 1.43.7, 1.44.4, 1.45.2.
-
Low 2.1
Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Skin/Skin.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
-
Low 2.0
Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Page/Article.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
-
Low 1.3
RecentChanges entries expose suppressed content via generated log page html
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
-
Low 1.1
Special:UserRights allows viewing user rights from private wiki
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Specials/SpecialUserRights.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4…
-
None 0.0
action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request
Vulnerability in Wikimedia Foundation MediaWiki. This vulnerability is associated with program files includes/Actions/ActionEntryPoint.Php, includes/Request/FauxResponse.Php. This issue affects MediaWiki: from * before 1.43.7, 1.44.4, 1.45.2.
Revision history
-
#5
Neue Updates von Debian aufgenommen
-
#4
Neue Updates von Ubuntu aufgenommen
-
#3
Referenz(en) aufgenommen: EUVD-2026-29064, EUVD-2026-29063, EUVD-2026-29062, EUVD-2026-29061, EUVD-2026-29060, EUVD-2026-29058, EUVD-2026-29059, EUVD-2026-29107, EUVD-2026-29157, EUVD-2026-29109, EUVD-2026-29108
-
#2
Neue Updates von Debian aufgenommen
-
#1
Initiale Fassung
References
-
Security and maintenance release vom 2026-03-31
https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/DIBLSBHISKX6NFRUFNOGZRVW42E7R2QP/
-
Debian Security Advisory DSA-6208 vom 2026-04-12
https://lists.debian.org/debian-security-announce/2026/msg00118.html
-
Ubuntu Security Notice USN-8315-1 vom 2026-05-27
https://ubuntu.com/security/notices/USN-8315-1
-
Debian Security Advisory DLA-4640 vom 2026-06-22
https://lists.debian.org/debian-lts-announce/2026/06/msg00029.html