PT-2025-17856 · Mediawiki · Managewiki

Universal-Omega · Published 2025-04-24 · Updated 2025-04-25 · CVE-2025-43861

Positive Technologies (AI Summary)

CVSS v3.1

5.4

Medium

Base vector

AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions ManageWiki versions prior to commit 2f177dc

Description The issue concerns a reflected or stored XSS vulnerability in the review dialog of ManageWiki, a MediaWiki extension. An attacker with a logged-in session can exploit this by modifying a form field to include malicious payload. When the "Review Changes" dialog is opened, the payload is rendered and executed within the attacker's own session context.

Recommendations For versions prior to commit 2f177dc, update to a version that includes the patch from commit 2f177dc to resolve the issue. As a temporary workaround, consider restricting access to the review dialog until the patch is applied. Avoid using the review dialog with untrusted input until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-43861

GHSA-859X-46H8-VCRV

Affected Products

Managewiki

References · 8

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/43xxx/CVE-2025-43861.json · Exploit
• https://github.com/miraheze/ManageWiki/security/advisories/GHSA-859x-46h8-vcrv · Patch
• https://github.com/miraheze/ManageWiki/commit/2f177dc83b28b727613215b835d4036cb179e4ab · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2025-43861 · Security Note
• https://osv.dev/vulnerability/CVE-2025-43861 · Vendor Advisory
• https://twitter.com/CVEnew/status/1915514863050231881 · Twitter Post
• https://t.me/cvetracker/22326 · Telegram Post
• https://t.me/cvedetector/23706 · Telegram Post