MediaWiki Extension Vulnerability Affecting ManageWiki by Miraheze
CVE-2025-32964

4.6MEDIUM

Key Information:

Vendor

Miraheze

Status
Managewiki
Vendor
CVE Published:
22 April 2025
đź”” Create Miraheze Vulnerability Alert

What is CVE-2025-32964?

The ManageWiki extension for MediaWiki has a vulnerability that allows conflicting extensions to be automatically disabled, potentially exposing users to permission issues. When a restricted extension is enabled, it inadvertently disables other extensions without requiring the appropriate user rights. This flaw can be mitigated by ensuring that any extensions relying on specific permissions in $wgManageWikiExtensions also necessitate those permissions for managing conflicting extensions. The issue has been addressed in commit 00bebea.

Affected Version(s)

ManageWiki < 00bebea

References

https://github.com/miraheze/ManageWiki/security/advisorie...
x_refsource_CONFIRM
https://github.com/miraheze/ManageWiki/commit/00bebea43a3...
x_refsource_MISC

CVSS V3.1

Score:
4.6
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.