Cross-Site Scripting Vulnerability in Wikimedia Foundation Mediawiki - RefreshSpecial Extension
CVE-2025-23072

5.4MEDIUM

Key Information:

Vendor
Wikimedia Foundation
Status
Mediawiki - Refreshspecial Extension
Vendor
CVE Published:
14 January 2025

Summary

An improper neutralization of input during web page generation vulnerability exists in the Wikimedia Foundation's Mediawiki - RefreshSpecial Extension. This flaw allows attackers to execute malicious scripts in the context of a user's session, potentially stealing sensitive information or hijacking user sessions. The affected versions include those prior to 1.39.11, 1.41.3, and 1.42.2. It is crucial for users to update to the latest versions to mitigate this security risk.

Affected Version(s)

Mediawiki - RefreshSpecial Extension 1.39.x < 1.39.11

Mediawiki - RefreshSpecial Extension 1.41.x < 1.41.3

Mediawiki - RefreshSpecial Extension 1.42.x < 1.42.2

References

https://phabricator.wikimedia.org/T378885
https://gerrit.wikimedia.org/r/q/Ic9547e80a8296d707ad8a15...

CVSS V3.1

Score:
5.4
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
Low
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

.