PT-2025-28247 · Mediawiki · Abusefilter Extension+1

Dreamy_Jazz · Published 2025-07-07 · Updated 2025-07-07 · CVE-2025-53499

Positive Technologies · (AI Summary)

CVSS v3.1

9.1

Critical

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Mediawiki - AbuseFilter Extension versions 1.39.0 through 1.39.12 Mediawiki - AbuseFilter Extension versions 1.42.0 through 1.42.6 Mediawiki - AbuseFilter Extension versions 1.43.0 through 1.43.1

Description: The issue is related to a Missing Authorization vulnerability in the Mediawiki - AbuseFilter Extension, allowing unauthorized access.

Recommendations: For versions 1.39.0 through 1.39.12, update to version 1.39.13 or later. For versions 1.42.0 through 1.42.6, update to version 1.42.7 or later. For versions 1.43.0 through 1.43.1, update to version 1.43.2 or later.

Fix

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

CVE-2025-53499

Affected Products

Abusefilter Extension

Mediawiki

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2025-53499 · Security Note
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/AbuseFilter/+/1166045 · Note
• https://phabricator.wikimedia.org/T397196 · Note
• https://twitter.com/CVEnew/status/1942301335573127598 · Twitter Post