Detections
Analytics
MediaWiki < 1.39.13 Multiple Vulnerabilities
medium Web App Scanning Plugin ID 115338
Synopsis
MediaWiki < 1.39.13 Multiple VulnerabilitiesDescription
According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.39.13, 1.42.x prior to 1.42.7 or 1.43.x prior to 1.43.2. It is, therefore, affected by a number of vulnerabilities as follows.- Failure to escape the newpage message in FeedUtils enabling XSS attacks. (CVE-2025-32072)
- BlockList discloses rows containing suppressed users. (CVE-2025-6589)
- Failure to escape usernames in HTMLUserTextField validation errors enabling XSS attacks. (CVE-2025-6590)
- Failure to escape i18n messages in the action=feedcontributions API enabling XSS attacks. (CVE-2025-6591)
- Account creation links a temporary username/IP with the real username. (CVE-2025-6592)
- IP address leak to an unverified email. (CVE-2025-6593)
- Reflected XSS in apisandbox when an invalid 'format' value is provided. (CVE-2025-6594)
- Stored XSS through system messages in MultimediaViewer. (CVE-2025-6595)
- Vector inserts portlet labels as HTML, allowing stored XSS. (CVE-2025-6596)
- Autocreation is treated as a login for reauthentication. (CVE-2025-6597)
- Extensions are unable to suppress the reauth flag on login. (CVE-2025-6926)
- Autoblocks visibility and hidden username leaks. (CVE-2025-6927)
Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to MediaWiki version 1.39.13 or later.See Also
Plugin Details
Severity: Medium
ID: 115338
Type: Version Based
Family: Component Vulnerability
Published: 7/28/2026
Updated: 7/28/2026
Scan Template: api, basic, full, pci, scan
Risk Information
VPR
Risk Factor: Medium
Score: 4.9
Percentile: 57.15
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2025-6926
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score Source: CVE-2025-6592
CVSS v4
Risk Factor: Medium
Base Score: 6.9
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L
CVSS Score Source: CVE-2025-32072
Vulnerability Information
CPE: cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 4/10/2025
Reference Information
CVE: CVE-2025-32072, CVE-2025-6589, CVE-2025-6590, CVE-2025-6591, CVE-2025-6592, CVE-2025-6593, CVE-2025-6594, CVE-2025-6595, CVE-2025-6596, CVE-2025-6597, CVE-2025-6926, CVE-2025-6927
CWE: 116, 200, 22, 284, 287, 79
OWASP: 2010-A2, 2010-A3, 2010-A4, 2010-A6, 2010-A8, 2013-A2, 2013-A3, 2013-A4, 2013-A5, 2013-A7, 2013-A9, 2017-A2, 2017-A5, 2017-A6, 2017-A7, 2017-A9, 2021-A1, 2021-A3, 2021-A6, 2021-A7, 2025-A1, 2025-A5, 2025-A6, 2025-A7
WASC: Cross-Site Scripting, Improper Output Handling, Information Leakage, Insufficient Authentication, Insufficient Authorization, Path Traversal
CAPEC: 104, 114, 115, 116, 126, 13, 151, 169, 19, 194, 209, 22, 224, 285, 287, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 312, 313, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 441, 472, 478, 479, 497, 502, 503, 508, 536, 546, 550, 551, 552, 556, 558, 562, 563, 564, 57, 573, 574, 575, 576, 577, 578, 588, 59, 591, 592, 593, 60, 616, 63, 633, 64, 643, 646, 650, 651, 73, 76, 78, 79, 81, 85, 94
DISA STIG: APSC-DV-000460, APSC-DV-002490, APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)
ISO: 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3, sp800_53-CM-6b, sp800_53-SI-10, sp800_53-SI-15
OWASP API: 2019-API7, 2019-API8, 2023-API8
OWASP ASVS: 4.0.2-1.4.2, 4.0.2-12.3.1, 4.0.2-14.2.1, 4.0.2-5.2.1, 4.0.2-5.3.3, 4.0.2-8.3.4
PCI-DSS: 3.2-6.2, 3.2-6.5, 3.2-6.5.10, 3.2-6.5.7, 3.2-6.5.8