PT-2025-4811 · Mediawiki · Mediawiki

Blankeclair · Published 2025-01-14 · Updated 2025-01-18 · CVE-2025-23081

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Mediawiki - DataTransfer Extension versions 1.39.X through 1.39.10 Mediawiki - DataTransfer Extension versions 1.41.X through 1.41.2 Mediawiki - DataTransfer Extension versions 1.42.X through 1.42.1

Description The issue affects the Mediawiki - DataTransfer Extension, allowing Cross Site Request Forgery and Cross-Site Scripting (XSS) due to improper neutralization of input during web page generation.

Recommendations For versions 1.39.X through 1.39.10, update to version 1.39.11 or later. For versions 1.41.X through 1.41.2, update to version 1.41.3 or later. For versions 1.42.X through 1.42.1, update to version 1.42.2 or later.

Fix

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

CVE-2025-23081

GHSA-C3H5-H73C-29HQ

Affected Products

Mediawiki

References · 12

• https://nvd.nist.gov/vuln/detail/CVE-2025-23081 · Security Note
• https://osv.dev/vulnerability/GHSA-c3h5-h73c-29hq · Vendor Advisory
• https://github.com/wikimedia/mediawiki-extensions-DataTransfer · Note
• https://t.me/cvedetector/15301 · Telegram Post
• https://twitter.com/CVEnew/status/1880761226092794143 · Twitter Post
• https://gerrit.wikimedia.org/r/q/I773c616db781d2f3f30893ad01ef503bf251a2b3 · Note
• https://phabricator.wikimedia.org/T379749 · Note
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1080451 · Note
• https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1093931 · Note
• https://gerrit.wikimedia.org/r/q/I5e1538a3bf66378810f905834c05626e1d2c82f0 · Note
• https://gerrit.wikimedia.org/r/q/I9223c31f02f31f1e06e1a8cddf7d539cc8d3a3d9 · Note
• https://gerrit.wikimedia.org/r/q/I7c9de4c8dcdb3276ba923c6bc7c8eef3531324c7 · Note