PT-2025-50559 · Mediawiki · Tableprogresstracking

Publicado 2025-12-10 · Atualizado 2025-12-11 · CVE-2025-67646

Positive Technologies (AI Summary)

CVSS v3.1

3.5

Baixa

Vetor base

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions TableProgressTracking versions 1.2.0 and below

Description TableProgressTracking is a MediaWiki extension used to track progress against specific criteria. Versions 1.2.0 and below do not validate Cross-Site Request Forgery (CSRF) tokens in the REST API. This allows an attacker to create a malicious webpage that, when visited by an authenticated user, can trigger unintended authenticated actions through the victim’s browser. Specifically, an attacker can delete or track progress against tables due to the missing CSRF protection. The issue is addressed in version 1.2.1.

Recommendations Update to TableProgressTracking version 1.2.1 or later.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2025-67646

GHSA-J24F-HW6W-CQ78

Produtos afetados

Tableprogresstracking

Referências · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/67xxx/CVE-2025-67646.json · Exploit
• https://github.com/Telepedia/TableProgressTracking/commit/e2aa8c4b3bb78989c6fe39070a95a26d22b91c94 · Nota
• https://github.com/Telepedia/TableProgressTracking/security/advisories/GHSA-j24f-hw6w-cq78 · Nota
• https://osv.dev/vulnerability/CVE-2025-67646 · Aviso do Fabricante
• https://twitter.com/VulmonFeeds/status/1999099318842675530 · Publicação no Twitter
• https://twitter.com/CVEnew/status/1999108894283776490 · Publicação no Twitter
• https://t.me/CVEtracker/39429 · Publicação no Telegram
• https://nvd.nist.gov/vuln/detail/CVE-2025-67646 · Nota de Segurança