PT-2025-16138 · Mediawiki+1 · Mediawiki+1

Blankeclair · Published 2025-04-11 · Updated 2025-04-12 · CVE-2025-32074

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions: Mediawiki - Confirm Account Extension versions 1.39 through 1.43

Description: The issue is related to improper encoding or escaping of output, which enables Cross-Site Scripting (XSS) in the Mediawiki - Confirm Account Extension. This is due to an output escaping issue.

Recommendations: For versions 1.39 through 1.43, consider disabling the affected extension until a patch is available to prevent Cross-Site Scripting (XSS) attacks. Restrict access to sensitive areas of the application that utilize the Confirm Account Extension to minimize the risk of exploitation.

Fix

Improper Encoding or Escaping of Output

Weakness Enumeration

CWE-116

Related Identifiers

CVE-2025-32074

Affected Products

Confirm Account Extension

Mediawiki

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2025-32074 · Security Note
• https://gerrit.wikimedia.org/r/q/I86f47103ffb78c671890b44ccd59fcff6613975f · Note
• https://phabricator.wikimedia.org/T386908 · Note
• https://twitter.com/VulmonFeeds/status/1910818023545434293 · Twitter Post
• https://t.me/cvetracker/21446 · Telegram Post
• https://t.me/cvedetector/22767 · Telegram Post
• https://twitter.com/cybercronai/status/1911103490358649236 · Twitter Post
• https://twitter.com/CveFindCom/status/1910732423727383032 · Twitter Post
• https://twitter.com/CVEnew/status/1910773222569849058 · Twitter Post