Advisories · Technology
Wikimedia Foundation MediaWiki.
Every CVE that names Wikimedia Foundation MediaWiki among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 5.9 Medium
Remote Code Execution via Unsafe Deserialization in LogItem Import
- Wikimedia Foundation MediaWiki
- Code injection
- Insecure deserialization
- CVSS 5.3 Medium
Full Account Takeover from BotPasswords and OAuth via action=changeauthenticationdata
- Wikimedia Foundation MediaWiki
- Authentication bypass
- CVSS 0.0 None
Pretty-printed API output combined with centralauthtoken allows XSS with certain gadgets
- Wikimedia Foundation MediaWiki
- Wikimedia Foundation CentralAuth
- Cross-site scripting (XSS)
- CVSS 0.0 None
$wgNonincludableNamespaces can be bypassed by embedding redirect in other namespaces
- Wikimedia Foundation MediaWiki
- Information disclosure
- CVSS 5.3 Medium
mw.Api.getErrorMessage() may return injected HTML if used without errorformat=html
- Wikimedia Foundation MediaWiki
- Cross-site scripting (XSS)
- CVSS 5.3 Medium
"Total number of distinct authors" statistic at action=info does not exclude revisions where the author name was deleted
- Wikimedia Foundation MediaWiki
- Information disclosure
- CVSS 0.0 None
Core log entries for exceptions and XSS issues in log entry formatting code that may be caused by user-controlled input
- Wikimedia Foundation MediaWiki
- Cross-site scripting (XSS)
- CVSS 2.1 Low
Users API leaks whether privileged users have their user groups disabled for lack of 2FA
- Wikimedia Foundation MediaWiki
- Information disclosure
- CVSS 5.1 Medium
API identification of users on private wikis
- Wikimedia Foundation MediaWiki
- Information disclosure
- CVSS 0.0 None
Stored i18n XSS in Special:ApiSandbox when a deprecated module is selected
- Wikimedia Foundation MediaWiki
- Cross-site scripting (XSS)
- CVSS 0.0 None
Stored XSS through a system message in the codex version of Special:Block
- Wikimedia Foundation MediaWiki
- Cross-site scripting (XSS)
- CVSS 0.0 None
action=raw with Special:Mypage subpage title responds with "Content-Type: text/html" on ctype=text/javascript request
- Wikimedia Foundation MediaWiki
- Information disclosure
- CVSS 2.0 Low
Customized help link for page protection indicator is relative to subpage name, because the link target is missing the "/wiki/" prefix
- Wikimedia Foundation MediaWiki
- Information disclosure
- CVSS 1.1 Low
Special:UserRights allows viewing user rights from private wiki
- Wikimedia Foundation MediaWiki
- Information disclosure
- CVSS 2.1 Low
Block UI elements in 'tools'-sidebar shows presence of an autoblocked IP
- Wikimedia Foundation MediaWiki
- Information disclosure
- CVSS 5.5 Medium
User localization leaked by AbuseFilter + EventStream
- Wikimedia Foundation MediaWiki
- Information disclosure
- CVSS 1.3 Low
RecentChanges entries expose suppressed content via generated log page html
- Wikimedia Foundation MediaWiki
- Information disclosure
- CVSS 0.0 None
mw.message(…).parse() doesn't output safe HTML, but it's being used as if it does
- Wikimedia Foundation MediaWiki
- Cross-site scripting (XSS)
- CVSS 0.0 None
Theoretical i18n XSS in mediawiki.page.preview.js when a page has multiple protection levels
- Wikimedia Foundation MediaWiki
- Cross-site scripting (XSS)
- CVSS 0.0 None
Action API xslt option allows JavaScript execution by administrators who are not interface administrators
- Wikimedia Foundation MediaWiki
- CWE-20
- CVSS 0.0 None
list=allrevisions can be used to bypass Extension:Lockdown
- Wikimedia Foundation MediaWiki
- CWE-20
- CVSS 0.0 None
Stored XSS through edit summaries in MW Core
- Wikimedia Foundation MediaWiki
- Cross-site scripting (XSS)
- CVSS 1.3 Low
Importing leaks IP address of importer via EventStreams
- Wikimedia Foundation MediaWiki
- CVSS 0.0 None
Stored XSS through a system message in Special:ApiSandbox
- Wikimedia Foundation MediaWiki
- Cross-site scripting (XSS)
- CVSS 0.0 None
Magic word replacement in legacy parser allows using reserved data attributes through wikitext
- Wikimedia Foundation MediaWiki
- Wikimedia Foundation Cite
- CVSS 0.0 None
Stored i18n XSS exposed by security patch for T402077
- Wikimedia Foundation MediaWiki
- Cross-site scripting (XSS)
- CVSS 0.0 None
CodexTablePager has i18n XSS
- Wikimedia Foundation MediaWiki
- Cross-site scripting (XSS)
- CVSS 1.2 Low
Watchlist group mode reveals authors of edits with hidden authorship
- Wikimedia Foundation MediaWiki
- Path traversal
- CVSS 0.0 None
i18n XSS through Special:Watchlist
- Wikimedia Foundation MediaWiki
- Cross-site scripting (XSS)
- CVSS 0.0 None
Stored XSS through system messages in MW Core
- Wikimedia Foundation MediaWiki
- Cross-site scripting (XSS)
- CVSS 0.0 None
Sanitizer::validateAttributes data-XSS
- Wikimedia Foundation MediaWiki
- Wikimedia Foundation Parsoid
- Cross-site scripting (XSS)
- CVSS 1.7 Low
Suppressed blocked IP is visible in Special:BlockList, RC, and other places
- Wikimedia Foundation MediaWiki
- Information disclosure
- CVSS 0.0 None
Stored XSS through system messages in Special:RecentChangesLinked (MW Core)
- Wikimedia Foundation MediaWiki
- Cross-site scripting (XSS)
- CVSS 1.7 Low
API list=allpages with maxsize is making really slow queries
- Wikimedia Foundation MediaWiki
- Path traversal
- CVSS 0.0 None
Stored XSS through system messages provided to CodexHtmlForms
- Wikimedia Foundation MediaWiki
- Cross-site scripting (XSS)
- CVSS 2.7 Low
EventStreams publishes suppressed recent change entries that are suppressed from their creation
- Wikimedia Foundation MediaWiki
- CVSS 0.0 None
HTML rest endpoint needs PoolCounter and proper parser cache check
- Wikimedia Foundation MediaWiki
- CVSS 0.0 None
Codex Special:Block vulnerable to message key XSS
- Wikimedia Foundation MediaWiki
- Cross-site scripting (XSS)
- CVSS 2.1 Low
With MultiBlocks enabled and a user who is suppressed via a MultiBlock, a user without 'hideuser' can see the hidden username in the BlockList
- Wikimedia Foundation MediaWiki
- Path traversal
- CVSS 4.6 Medium
Complete content leak of private wikis due to PasswordReset Wikitext injection in error message
- Wikimedia Foundation MediaWiki
- Information disclosure
- CVSS 0.0 None
HTML injection in API action=feedcontributions output from i18n message
- Wikimedia Foundation MediaWiki
- Cross-site scripting (XSS)
- CVSS 2.1 Low
"{{SITENAME}} registered email address has been changed" email sent to unverified email addresses
- Wikimedia Foundation MediaWiki
- Information disclosure
- CVSS 0.0 None
XSS in Special:ApiSandbox
- Wikimedia Foundation MediaWiki
- Cross-site scripting (XSS)
- CVSS 0.0 None
MediaWiki should not consider autocreation as login for the purposes of security reauthentication
- Wikimedia Foundation MediaWiki
- Path traversal
- CVSS 2.3 Low
Autoblocks from global account suppressions are publicly visible
- Wikimedia Foundation MediaWiki
- Path traversal
- CVSS 2.3 Low
AbuseFilter log interfaces expose global private and hidden filters when central DB is not available
- Wikimedia Foundation MediaWiki
- Information disclosure
- CVSS 2.1 Low
Potential javascript injection attack enabled by Unicode normalization in Action API
- Wikimedia Foundation MediaWiki
- Wikimedia Foundation Parsoid
- Other injection
- Cross-site scripting (XSS)
- CVSS 2.1 Low
LogPager.php: Restriction enforcer functions do not correctly enforce suppression restrictions
- Wikimedia Foundation MediaWiki
- Information disclosure
- CVSS 0.0 None
Cascading protection is not preventing file reversions
- Wikimedia Foundation MediaWiki
- CWE-281
- CVSS 0.0 None
"reupload-own" restriction can be bypassed by reverting file
- Wikimedia Foundation MediaWiki
- CWE-281
- CVSS 0.0 None
i18n XSS vulnerability in HTMLMultiSelectField when sections are used
- Wikimedia Foundation MediaWiki
- Cross-site scripting (XSS)
-
Wikimedia Foundation MediaWiki: The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8…
- Wikimedia Foundation MediaWiki
-
Wikimedia Foundation MediaWiki: Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10…
- Wikimedia Foundation MediaWiki
-
Wikimedia Foundation MediaWiki: The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4…
- Wikimedia Foundation MediaWiki
-
Wikimedia Foundation MediaWiki: includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8…
- Wikimedia Foundation MediaWiki