Debian dla-4249 : mediawiki - security update

medium Nessus Plugin ID 242647

Synopsis

The remote Debian host is missing one or more security-related updates.

Description

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4249 advisory.

------------------------------------------------------------------------- Debian LTS Advisory DLA-4249-1 [email protected] https://www.debian.org/lts/security/ Guilhem Moulin July 23, 2025 https://wiki.debian.org/LTS
-------------------------------------------------------------------------

Package : mediawiki Version : 1:1.35.13-1+deb11u4 CVE ID : CVE-2025-3469 CVE-2025-6590 CVE-2025-6591 CVE-2025-6593 CVE-2025-6594 CVE-2025-6595 CVE-2025-6597 CVE-2025-6926 CVE-2025-32072 CVE-2025-32696 CVE-2025-32698 CVE-2025-32699

Multiple security vulnerabilities were found in mediawiki, a website engine for collaborative work, that could lead to information disclosure or privilege escalation.

CVE-2025-3469

User input was not properly sanitized during web page generation, which could lead to information disclosure or privilege escalation via Cross-site Scripting.

CVE-2025-6590

User input was not sanitized in the password reset form, which could lead to information disclosure for private pages via transclusion.

CVE-2025-6591

HTML injection in API `action=feedcontributions` output from i18n messages.

CVE-2025-6593

{{SITENAME}} registered email address has been changed email was sent to unverified email addresses, which could lead to information disclosure.

CVE-2025-6594

XSS in Special:ApiSandbox. While the known issue is not exploitable in 1.39, the backported changes provide some security hardening just in case.

CVE-2025-6595

Stored XSS through system messages in MultimediaViewer.

CVE-2025-6597

Autocreation was treated as login for the purposes of security reauthentication. However it doesn't necessarily involve real-time user identification, as it can be based on some provider identifying the user based on a session cookie or similar low-fidelity information. An attacker who got hold of a CentralAuth session cookie (valid on any wiki) could just visit a wiki where the user has no local account yet, get an account autocreated, and then change credentials or perform other sensitive operations.

CVE-2025-6926

Allow extensions to suppress the reauth flag on login. This is a workaround for extensions with some sort of autologin implemented via the login page to indicate that the login flow didn't involve the user actually logging in, it merely copied some central login state, and so isn't appropriate for the reauthentication flag.

CVE-2025-32072

HTML injection in feed output from i18n message.

CVE-2025-32696

reupload-own restriction could be bypassed by reverting file.

CVE-2025-32698

Improper enforcing of suppression restrictions in LogPager.php.

CVE-2025-32699

Potential javascript injection attack enabled by Unicode normalization in Action API.

For Debian 11 bullseye, these problems have been fixed in version 1:1.35.13-1+deb11u4.

We recommend that you upgrade your mediawiki packages.

For the detailed security status of mediawiki please refer to its security tracker page at:
https://security-tracker.debian.org/tracker/mediawiki

Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS Attachment:
signature.asc Description: PGP signature

Tenable has extracted the preceding description block directly from the Debian security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Solution

Upgrade the mediawiki packages.

Plugin Details

Severity: Medium

ID: 242647

File Name: debian_DLA-4249.nasl

Version: 1.1

Type: local

Agent: unix

Family: Debian Local Security Checks

Published: 7/23/2025

Updated: 7/23/2025

Supported Sensors: Agentless Assessment, Continuous Assessment, Frictionless Assessment Agent, Nessus Agent, Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS Score Source: CVE-2025-6926

CVSS v3

Risk Factor: High

Base Score: 8.8

Temporal Score: 7.7

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

CVSS v4

Risk Factor: Medium

Base Score: 6.9

Threat Score: 2.7

Threat Vector: CVSS:4.0/E:U

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L

CVSS Score Source: CVE-2025-32072

Vulnerability Information

CPE: cpe:/o:debian:debian_linux:11.0, p-cpe:/a:debian:debian_linux:mediawiki-classes, p-cpe:/a:debian:debian_linux:mediawiki

Required KB Items: Host/local_checks_enabled, Host/Debian/release, Host/Debian/dpkg-l

Exploit Ease: No known exploits are available

Patch Publication Date: 7/23/2025

Vulnerability Publication Date: 4/10/2025

Reference Information

CVE: CVE-2025-32072, CVE-2025-32696, CVE-2025-32698, CVE-2025-32699, CVE-2025-3469, CVE-2025-6590, CVE-2025-6591, CVE-2025-6593, CVE-2025-6594, CVE-2025-6595, CVE-2025-6597, CVE-2025-6926

Detections

Analytics