PT-2025-42816 · Unknown · Mediawiki Globalblocking

Dreamy_Jazz · Published 2025-10-20 · Updated 2025-10-21 · CVE-2025-62656

Positive Technologies (AI Summary)

CVSS v4.0

5.8

Medium

Base vector

AV:N/AC:H/AT:N/PR:H/UI:P/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:N/R:U/V:C/RE:L/U:Amber

Name of the Vulnerable Software and Affected Versions MediaWiki GlobalBlocking extension versions 1.43 and 1.44

Description The MediaWiki GlobalBlocking extension contains a flaw related to improper input handling during web page generation, potentially leading to Stored Cross-site Scripting (XSS). This issue could allow an attacker to inject malicious scripts into web pages viewed by other users. The affected component is the GlobalBlocking extension.

Recommendations Update the MediaWiki GlobalBlocking extension to a fixed version.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-62656

Affected Products

Mediawiki Globalblocking

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2025-62656 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-62656 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-62656 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-62656 · Vendor Advisory
• https://phabricator.wikimedia.org/T403291 · Note
• https://twitter.com/CVEnew/status/1980374106815004948 · Twitter Post
• https://t.me/cveNotify/139536 · Telegram Post
• https://t.me/CVEtracker/35355 · Telegram Post