PatchFirst · Latest vulnerabilities

mediawiki vulnerabilities · Page 8

Vulnerabilities published for mediawiki in the last 30 days: 11. Listed in the KEV catalogue: 0.

RSS ↗ JSON ↗

Vulnerabilities: 191

CVE-2022-31090
High · CVSS 7.7EPSS 1.92%No fix published
CURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle
Guzzle, an extensible PHP HTTP client. `Authorization` headers on requests are sensitive information. In affected versions when using our Curl handler, it is possible to use the `CURLOPT_HTTPAUTH` option to specify an `Authorization` header. On making a request which responds with a redirect to a URI with a different origin (change in host, scheme or port), if we choose to follow it, we should remove the `CURLOPT_HTTPAUTH` option before continuing, stopping curl from appending the `Authorization` header to the new request. Affected Guzzle 7 users should upgrade to Guzzle 7.4.5 as soon as possible. Affected users using any earlier series of Gu
mediawiki Operating systems
Published June 27, 2022Updated April 23, 2025
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2022-29969
Medium · CVSS 6.1EPSS 0.71%No fix published
CVE-2022-29969
The RSS extension before 2022-04-29 for MediaWiki allows XSS via an rss element (if the feed is in $wgRSSUrlWhitelist and $wgRSSAllowLinkTag is true).
mediawiki Operating systems
Published May 2, 2022Updated August 3, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2022-28202
Medium · CVSS 6.1EPSS 1.2%No fix published
CVE-2022-28202
An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.
mediawiki Operating systems
Published March 30, 2022Updated August 3, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2021-45471
Medium · CVSS 5.3EPSS 1.25%No fix published
CVE-2021-45471
In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items.
mediawiki Operating systems
Published December 24, 2021Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2021-45472
Medium · CVSS 6.1EPSS 1%No fix published
CVE-2021-45472
In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used.
mediawiki Operating systems
Published December 24, 2021Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2021-45473
Medium · CVSS 6.1EPSS 1.28%No fix published
CVE-2021-45473
In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-information sidebar).
mediawiki Operating systems
Published December 24, 2021Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2021-45474
Medium · CVSS 6.1EPSS 1%No fix published
CVE-2021-45474
In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl parameter.
mediawiki Operating systems
Published December 24, 2021Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2021-44858
High · CVSS 7.5EPSS 1.37%No fix published
CVE-2021-44858
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=mcrundo and action=mcrrestore to view private pages on a private wiki that has at least one page set in $wgWhitelistRead.
mediawiki Operating systems
Published December 20, 2021Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2021-41801
High · CVSS 8.8EPSS 1.16%No fix published
CVE-2021-41801
The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked after submitting a replace job, the job is still run, even if it may be run at a later time (due to the job queue backlog)
mediawiki Operating systems
Published October 11, 2021Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2021-41800
Medium · CVSS 5.3EPSS 1.86%No fix published
CVE-2021-41800
MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). Visiting Special:Contributions can sometimes result in a long running SQL query because PoolCounter protection is mishandled.
mediawiki Operating systems
Published October 11, 2021Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2021-41799
High · CVSS 7.5EPSS 1.7%No fix published
CVE-2021-41799
MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). ApiQueryBacklinks (action=query&list=backlinks) can cause a full table scan.
mediawiki Operating systems
Published October 11, 2021Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2021-41798
Medium · CVSS 6.1EPSS 1.44%No fix published
CVE-2021-41798
MediaWiki before 1.36.2 allows XSS. Month related MediaWiki messages are not escaped before being used on the Special:Search results page.
mediawiki Operating systems
Published October 11, 2021Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2021-42040
High · CVSS 7.5EPSS 1.16%No fix published
CVE-2021-42040
An issue was discovered in MediaWiki through 1.36.2. A parser function related to loop control allowed for an infinite loop (and php-fpm hang) within the Loops extension because egLoopsCountLimit is mishandled. This could lead to memory exhaustion.
mediawiki Operating systems
Published October 6, 2021Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2021-35197
High · CVSS 7.5EPSS 1.94%No fix published
CVE-2021-35197
In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "sitewide block" applied, it is able to still "purge" pages through the MediaWiki Action API (which a "sitewide block" should have prevented).
mediawiki Operating systems
Published July 2, 2021Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2021-30156
Medium · CVSS 4.3EPSS 1.14%No fix published
CVE-2021-30156
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Special:Contributions can leak that a "hidden" user exists.
mediawiki Operating systems
Published April 9, 2021Updated August 3, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2021-30152
Medium · CVSS 4.3EPSS 1.23%No fix published
CVE-2021-30152
An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is currently able to protect to a higher level than they currently have permissions for.
mediawiki Operating systems
Published April 9, 2021Updated August 3, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2021-30458
Medium · CVSS 6.1EPSS 0.98%No fix published
CVE-2021-30458
An issue was discovered in Wikimedia Parsoid before 0.11.1 and 0.12.x before 0.12.2. An attacker can send crafted wikitext that Utils/WTUtils.php will transform by using a <meta> tag, bypassing sanitization steps, and potentially allowing for XSS.
mediawiki Operating systems
Published April 9, 2021Updated August 3, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2021-30158
Medium · CVSS 5.3EPSS 1.73%No fix published
CVE-2021-30158
An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Blocked users are unable to use Special:ResetTokens. This has security relevance because a blocked user might have accidentally shared a token, or might know that a token has been compromised, and yet is not able to block any potential future use of the token by an unauthorized party.
mediawiki Operating systems
Published April 6, 2021Updated August 3, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2020-35479
Medium · CVSS 6.1EPSS 1.49%No fix published
CVE-2020-35479
MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. Language::translateBlockExpiry itself does not escape in all code paths. For example, the return of Language::userTimeAndDate is is always unsafe for HTML in a month value. This affects MediaWiki 1.12.0 and later.
mediawiki Operating systems
Published December 18, 2020Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗
CVE-2020-35480
Medium · CVSS 5.3EPSS 1.49%No fix published
CVE-2020-35480
An issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don't exist) and hidden users (accounts that have been explicitly hidden due to being abusive, or similar) that the viewer cannot see are handled differently, exposing sensitive information about the hidden status to unprivileged viewers. This exists on various code paths.
mediawiki Operating systems
Published December 18, 2020Updated August 4, 2024
Source advisory 1 ↗Source advisory 2 ↗Source advisory 3 ↗

Check your server

Check your installed stack and versions against the current vulnerability feeds.

Check your server →

mediawiki vulnerabilities · Page 8

CURLOPT_HTTPAUTH option not cleared on change of origin in Guzzle

CVE-2022-29969

CVE-2022-28202

CVE-2021-45471

CVE-2021-45472

CVE-2021-45473

CVE-2021-45474

CVE-2021-44858

CVE-2021-41801

CVE-2021-41800

CVE-2021-41799

CVE-2021-41798

CVE-2021-42040

CVE-2021-35197

CVE-2021-30156

CVE-2021-30152

CVE-2021-30458

CVE-2021-30158

CVE-2020-35479

CVE-2020-35480

Check your server