PT-2025-42865 · Unknown+1 · Lockdown Extension+2

Daniel + 1 · Published 2025-10-21 · Updated 2025-10-21 · CVE-2025-12004

Positive Technologies (AI Summary)

CVSS v4.0

10

Critical

Base vector

AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Name of the Vulnerable Software and Affected Versions Mediawiki - Lockdown Extension versions prior to 1.42

Description The Mediawiki Lockdown Extension contains a flaw related to incorrect permission assignment for critical resources, which allows for privilege abuse. The issue resides in the compare API module and enables attackers to bypass permissions, potentially leading to complete privilege escalation without authentication. The problem is fixed in the Mediawiki Core Action API.

Recommendations Upgrade to version 1.42 or later to resolve this vulnerability.

Exploit

Fix

LPE

Incorrect Permission

Weakness Enumeration

CWE-732

Related Identifiers

CVE-2025-12004

Affected Products

Lockdown Extension

Mediawiki

Mediawiki Core Action Api

References · 12

• 🔥 https://phabricator.wikimedia.org/T397521 · Exploit
• https://ubuntu.com/security/CVE-2025-12004 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-12004 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-12004 · Security Note
• https://cve.org/CVERecord?id=CVE-2025-12004 · Security Note
• https://gerrit.wikimedia.org/r/q/Id275382743957004fa7fc56318fc104d8e2d267b · Note
• https://twitter.com/CveFindCom/status/1980524319722569736 · Twitter Post
• https://twitter.com/CVEnew/status/1980527019780935987 · Twitter Post
• https://t.me/CVEtracker/35384 · Telegram Post
• https://twitter.com/offseq/status/1980530173758849422 · Twitter Post
• https://twitter.com/0dayPublishing/status/1980520507955912832 · Twitter Post
• https://t.me/cveNotify/139559 · Telegram Post