Detections
Analytics
MediaWiki 1.43.x < 1.43.6 Multiple Vulnerabilities
medium Web App Scanning Plugin ID 115329
Synopsis
MediaWiki 1.43.x < 1.43.6 Multiple VulnerabilitiesDescription
According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.39.16, 1.43.x prior to 1.43.6, 1.44.x prior to 1.44.3 or 1.45.x prior to 1.45.1. It is, therefore, affected by a number of vulnerabilities as follows.- The xslt option is enabled by default in API format=xml responses. (CVE-2025-67484)
- Failure to escape the word-separator message in Special:ApiSandbox. (CVE-2025-67477)
- Failure to escape square brackets in autocomment links. (CVE-2025-67475)
- The importer's IP is used in case of an external revision author, leading to information disclosure. (CVE-2025-67476)
- Failure to always escape commas in mail encoded-words. (CVE-2025-67478)
- The Sanitizer does not disallow underscore and wide underscore in data-* attribute names. (CVE-2025-67479)
- Missing read permission check in ApiQueryRevisionsBase enabling an access control bypass. (CVE-2025-67480)
- Failure to escape the 'comma-separator' between multiple protection levels. (CVE-2025-67483)
- The 'style' attribute is allowed in client-side messages (jqueryMsg), enabling XSS. (CVE-2025-67481)
- A Lua segfault in unpack() leading to a denial of service. (CVE-2025-67482)
Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to MediaWiki version 1.43.6 or later.See Also
Plugin Details
Severity: Medium
ID: 115329
Type: Version Based
Family: Component Vulnerability
Published: 7/28/2026
Updated: 7/28/2026
Scan Template: api, basic, full, pci, scan
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.53
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2025-67478
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score Source: CVE-2025-67484
CVSS v4
Risk Factor: Medium
Base Score: 6.3
Vector: CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N
CVSS Score Source: CVE-2025-67482
Vulnerability Information
CPE: cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 12/18/2025
Reference Information
CVE: CVE-2025-67475, CVE-2025-67476, CVE-2025-67477, CVE-2025-67478, CVE-2025-67479, CVE-2025-67480, CVE-2025-67481, CVE-2025-67482, CVE-2025-67483, CVE-2025-67484
OWASP: 2010-A2, 2010-A4, 2010-A6, 2010-A8, 2013-A3, 2013-A4, 2013-A5, 2013-A7, 2013-A9, 2017-A5, 2017-A6, 2017-A7, 2017-A9, 2021-A1, 2021-A3, 2021-A6, 2025-A1, 2025-A5, 2025-A6
WASC: Cross-Site Scripting, Denial of Service, Improper Input Handling, Information Leakage, Insufficient Authorization
CAPEC: 10, 101, 104, 108, 109, 110, 116, 120, 13, 135, 136, 14, 147, 153, 169, 182, 197, 209, 22, 224, 23, 230, 231, 24, 250, 261, 267, 28, 285, 287, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 3, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 31, 310, 312, 313, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 42, 43, 45, 46, 47, 472, 473, 492, 497, 508, 52, 53, 573, 574, 575, 576, 577, 588, 59, 591, 592, 60, 616, 63, 64, 643, 646, 651, 67, 7, 71, 72, 73, 78, 79, 8, 80, 81, 83, 85, 88, 9
DISA STIG: APSC-DV-000460, APSC-DV-002400, APSC-DV-002490, APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)
ISO: 27001-A.12.6.1, 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3, sp800_53-CM-6b, sp800_53-SC-5, sp800_53-SI-10, sp800_53-SI-15
OWASP API: 2019-API7, 2023-API8
OWASP ASVS: 4.0.2-14.2.1, 4.0.2-5.1.3, 4.0.2-5.3.3, 4.0.2-8.3.4