Lucas Werkmeister

**Name of the Vulnerable Software and Affected Versions** MediaWiki versions 1.39.6 and earlier, 1.40.x versions prior to 1.40.2, 1.41.x versions prior to 1.41.1 **Description** An issue was discovered in WikibaseLexeme, related to inadequate access control. This issue allows an attacker to make an edit that merges the from-id to the to-id when loading Special:MergeLexemes, even if the request was not a POST request and does not contain an edit token. The exploitation of this issue may allow a remote attacker to elevate their privileges. **Recommendations** For MediaWiki versions 1.39.6 and earlier, update to version 1.39.6 or later. For MediaWiki 1.40.x versions prior to 1.40.2, update to version 1.40.2 or later. For MediaWiki 1.41.x versions prior to 1.41.1, update to version 1.41.1 or later. As a temporary workaround, consider restricting access to the Special:MergeLexemes page until a patch is available.

**Name of the Vulnerable Software and Affected Versions** Wikibase extension for MediaWiki versions 1.35.x through 1.35.11 Wikibase extension for MediaWiki versions 1.36.x through 1.39.4 Wikibase extension for MediaWiki versions 1.40.x through 1.40.0 **Description** An issue was discovered in the Wikibase extension for MediaWiki. There is no rate limit for merging items, which could allow a remote attacker to cause a denial of service. **Recommendations** For versions 1.35.x through 1.35.11, update to version 1.35.12 or later. For versions 1.36.x through 1.39.4, update to version 1.39.5 or later. For versions 1.40.x through 1.40.0, update to version 1.40.1 or later.

**Name of the Vulnerable Software and Affected Versions** MediaWiki versions prior to 1.35.9 MediaWiki versions 1.36.x through 1.38.x before 1.38.5 MediaWiki versions 1.39.x before 1.39.1 **Description** An issue was discovered in MediaWiki that allows JavaScript execution by staff/admin users who do not intentionally have the editsitejs capability. This is due to XSS in Wikibase date formatting via `wikibase-time-precision-*` fields. **Recommendations** For versions prior to 1.35.9, update to version 1.35.9 or later. For versions 1.36.x through 1.38.x before 1.38.5, update to version 1.38.5 or later. For versions 1.39.x before 1.39.1, update to version 1.39.1 or later. As a temporary workaround, consider restricting access to the `wikibase-time-precision-*` fields to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** MediaWiki versions through 1.38.1 **Description** An issue in MediaWiki allows the creation of larger lexemes than the capped length of a thousand characters, as this length is not validated. This introduces denial-of-service attack vectors within the Wikibase and WikibaseLexeme extensions, related to "Special:NewLexeme" and "Special:NewProperty". **Recommendations** For versions through 1.38.1, consider restricting the creation of new lexemes or validating the lemma length to prevent denial-of-service attacks. As a temporary workaround, restrict access to "Special:NewLexeme" and "Special:NewProperty" to minimize the risk of exploitation.

**Name of the Vulnerable Software and Affected Versions** Wikibase Wikidata Query Service GUI versions prior to 0.3.6-SNAPSHOT 2019-11-07 **Description** The issue allows for arbitrary JavaScript execution, which can occur when mathematical expressions in results are displayed directly. This can lead to XSS. The problem was addressed by introducing MathJax as a new mathematics rendering engine. **Recommendations** For versions prior to 0.3.6-SNAPSHOT 2019-11-07, update to a version that includes the new mathematics rendering engine, such as 0.3.6-SNAPSHOT or later, to prevent arbitrary JavaScript execution.

**Name of the Vulnerable Software and Affected Versions** MediaWiki versions 1.23.0 through 1.32.1 **Description** The issue is related to an information leak in MediaWiki, where privileged API responses may be cached publicly, potentially revealing whether a recent change has been patrolled. This could allow a remote attacker to gain unauthorized access to protected information. **Recommendations** For MediaWiki versions 1.23.0 through 1.32.1, update to version 1.32.2, 1.31.2, 1.30.2, or 1.27.6 to resolve the issue.