PT-2025-4808 · Mediawiki · Breadcrumbs2 Extension+1

Blankeclair · Published 2025-01-10 · Updated 2025-01-13 · CVE-2025-23078

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mediawiki - Breadcrumbs2 extension versions 1.39.X through 1.39.11 Mediawiki - Breadcrumbs2 extension versions 1.41.X through 1.41.5 Mediawiki - Breadcrumbs2 extension versions 1.42.X through 1.42.4

Description The issue is related to improper neutralization of input during web page generation, allowing Cross-Site Scripting (XSS). This enables attackers to inject malicious scripts into web pages, potentially leading to unauthorized actions or data theft.

Recommendations For versions 1.39.X through 1.39.11, update to a version after 1.39.11 to resolve the issue. For versions 1.41.X through 1.41.5, update to a version after 1.41.5 to resolve the issue. For versions 1.42.X through 1.42.4, update to a version after 1.42.4 to resolve the issue. As a temporary workaround, consider restricting access to the Breadcrumbs2 extension until a patch is available.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2025-23078

Affected Products

Breadcrumbs2 Extension

Mediawiki

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2025-23078 · Security Note
• https://gerrit.wikimedia.org/r/q/I7878f8f7bc067080f80427b90f8d85337f172711 · Note
• https://twitter.com/CVEnew/status/1877782191100575984 · Twitter Post
• https://t.me/cvedetector/14984 · Telegram Post
• https://phabricator.wikimedia.org/T382043 · Note