CVE-2024-25109mediumCWE-79

CVE-2024-25109: fallo de gravedad media en miraheze ManageWiki

Cross-Site Scripting in the extensions, settings, permissions and namespaces subpages of ManageWiki

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear ManageWiki

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.5epss 0.4%
ManageWiki is a MediaWiki extension allowing users to manage wikis. Special:ManageWiki does not escape escape interface messages on the `columns` and `help` keys on the form descriptor. An attacker may exploit this and would have a cross site scripting attack vector. Exploiting this on-wiki requires the `(editinterface)` right. Users should apply the code changes in commits `886cc6b94`, `2ef0f50880`, and `6942e8b2c` to resolve this vulnerability. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Productos afectados
miraheze · ManageWiki
CVEs relacionadas — miraheze ManageWiki

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-29483CRITICALwikiconfig API leaked private config variables set through ManageWikiEPSS 1.2%CVE-2025-32956HIGHManageWiki has SQL injection vulnerability in NamespaceMigrationJobEPSS 0.7%CVE-2025-43861MEDIUMManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflectionEPSS 0.3%CVE-2025-32964MEDIUMManageWiki vulnerable to permission bypass when disabling extensions requiring certain permissions in Special:ManageWiki/extensionsEPSS 0.2%