Detections
Analytics
MediaWiki < 1.39.12 Multiple Vulnerabilities
low Web App Scanning Plugin ID 115341
Synopsis
MediaWiki < 1.39.12 Multiple VulnerabilitiesDescription
According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.39.12, 1.42.x prior to 1.42.6 or 1.43.x prior to 1.43.1. It is, therefore, affected by a number of vulnerabilities as follows.- Improper restrictions on the file revert action. (CVE-2025-32696)
- PermissionManager fails to differentiate between cascading protection sources, allowing an unauthorized user to edit protected pages. (CVE-2025-32697)
- LogPager restriction enforcement functions do not properly restrict access to suppressed log entries. (CVE-2025-32698)
- Potential JavaScript injection via Unicode normalization enabling XSS attacks. (CVE-2025-32699)
- An i18n XSS vulnerability in HTMLMultiSelectField with sections. (CVE-2025-3469)
- AbuseFilter log interfaces expose private/hidden filters when they should be restricted. (CVE-2025-32700)
Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.
Solution
Upgrade to MediaWiki version 1.39.12 or later.See Also
Plugin Details
Severity: Low
ID: 115341
Type: Version Based
Family: Component Vulnerability
Published: 7/28/2026
Updated: 7/28/2026
Scan Template: api, basic, full, pci, scan
Risk Information
VPR
Risk Factor: Medium
Score: 4.3
Percentile: 53.04
CVSS v2
Risk Factor: Medium
Base Score: 6.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:N
CVSS Score Source: CVE-2025-32696
CVSS v3
Risk Factor: Critical
Base Score: 9.1
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CVSS Score Source: CVE-2025-32696
CVSS v4
Risk Factor: Low
Base Score: 2.3
Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:N/VA:N/SC:L/SI:N/SA:N
CVSS Score Source: CVE-2025-32700
Vulnerability Information
CPE: cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 4/9/2025
Reference Information
CVE: CVE-2025-32696, CVE-2025-32697, CVE-2025-32698, CVE-2025-32699, CVE-2025-32700, CVE-2025-3469
CWE: 200, 281, 74, 79, 862, 94
OWASP: 2010-A1, 2010-A2, 2010-A4, 2010-A6, 2010-A8, 2013-A1, 2013-A3, 2013-A4, 2013-A5, 2013-A7, 2013-A9, 2017-A1, 2017-A5, 2017-A6, 2017-A7, 2017-A9, 2021-A1, 2021-A3, 2021-A6, 2025-A1, 2025-A5, 2025-A6
WASC: Cross-Site Scripting, Improper Input Handling, Information Leakage, Insufficient Authorization, OS Commanding
CAPEC: 1, 10, 101, 108, 116, 120, 13, 135, 14, 169, 209, 22, 224, 24, 242, 250, 267, 273, 28, 285, 287, 290, 291, 292, 293, 294, 295, 296, 297, 298, 299, 3, 300, 301, 302, 303, 304, 305, 306, 307, 308, 309, 310, 312, 313, 317, 318, 319, 320, 321, 322, 323, 324, 325, 326, 327, 328, 329, 330, 34, 35, 42, 43, 45, 46, 47, 472, 497, 508, 51, 52, 53, 573, 574, 575, 576, 577, 588, 59, 591, 592, 6, 60, 616, 63, 64, 643, 646, 651, 67, 7, 71, 72, 76, 77, 78, 79, 8, 80, 83, 84, 85, 9
DISA STIG: APSC-DV-000460, APSC-DV-000500, APSC-DV-002490, APSC-DV-002510, APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)
ISO: 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3, sp800_53-CM-6b, sp800_53-SI-10, sp800_53-SI-15
OWASP API: 2019-API7, 2019-API8, 2023-API8
OWASP ASVS: 4.0.2-14.2.1, 4.0.2-4.1.4, 4.0.2-5.2.5, 4.0.2-5.3.3, 4.0.2-8.3.4