GitHub Advisoryadvisory · Packagist

GHSA-c3h5-h73c-29hq Mediawiki - DataTransfer Extension Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS)

MEDIUM Published 2025-01-14 Modified 2025-01-14 Official page ↗
Aliases
CVE-2025-23081
Ecosystem
Packagist
Packages
mediawiki/data-transfer
Severity
Moderate
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N
Weaknesses
CWE-79
Reviewed
2025-01-14

Affected packages

• Packagist mediawiki/data-transfer: >= 1.39.0, < 1.39.11 → fixed in 1.39.11 • Packagist mediawiki/data-transfer: >= 1.41.0, < 1.41.3 → fixed in 1.41.3 • Packagist mediawiki/data-transfer: >= 1.42.0, < 1.42.2 → fixed in 1.42.2

Description

Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects Mediawiki - DataTransfer Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

Related

Alias · CVE (1)

  • CVE-2025-23081 Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting')… vulnerability

Weakness · CWE (1)

  • CWE-79 Improper Neutralization of Input During Web Page Generation weakness

References