Cross-Site Scripting Vulnerability in Wikimedia Foundation's Mediawiki Confirm Account Extension
CVE-2025-32074
10CRITICAL
Summary
The Mediawiki Confirm Account Extension from the Wikimedia Foundation is susceptible to a Cross-Site Scripting (XSS) attack due to improper encoding or escaping of output. This vulnerability allows attackers to execute arbitrary JavaScript within the context of users' browsers, potentially leading to unauthorized actions or data theft. The affected versions span from 1.39 to 1.43, emphasizing the need for administrators to apply the latest security updates to mitigate this risk. Relevant references for administrators are available for further technical guidance.
Affected Version(s)
Mediawiki - Confirm Account Extension 1.39 <= 1.43
References
CVSS V4
Score:
10
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None
Timeline
Vulnerability published
Vulnerability Reserved
Credit
BlankEclair