PT-2025-17560 · Mediawiki · Managewiki

Universal-Omega · Published 2025-04-22 · Updated 2025-04-22 · CVE-2025-32964

Positive Technologies (AI Summary)

CVSS v3.1

4.6

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:L/A:L

Name of the Vulnerable Software and Affected Versions ManageWiki (affected versions not specified)

Description The issue concerns the ManageWiki MediaWiki extension, which allows users to manage wikis. Prior to a specific commit (00bebea), when a conflicting extension was enabled, a restricted extension would be automatically disabled, even if the user did not have the necessary ManageWiki-restricted right.

Recommendations For versions prior to commit 00bebea, ensure that any extensions requiring specific permissions in $wgManageWikiExtensions also require the same permissions for managing any conflicting extensions. At the moment, there is no information about a newer version that contains a fix for this vulnerability, but it has been patched in commit 00bebea.

Exploit

Fix

LPE

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

CVE-2025-32964

GHSA-CCRF-X5RP-GPPR

Affected Products

Managewiki

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/32xxx/CVE-2025-32964.json · Exploit
• https://github.com/miraheze/ManageWiki/security/advisories/GHSA-ccrf-x5rp-gppr · Patch
• https://github.com/miraheze/ManageWiki/commit/00bebea43a3e3ff0157b5f04df17c1d1e88a9acd · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-32964 · Security Note
• https://osv.dev/vulnerability/CVE-2025-32964 · Vendor Advisory
• https://twitter.com/CVEnew/status/1914734350320476354 · Twitter Post
• https://t.me/cvedetector/23557 · Telegram Post
• https://t.me/cvetracker/22152 · Telegram Post