CVE-2024-25109mediumCWE-79

CVE-2024-25109: falha de média gravidade em miraheze ManageWiki

Cross-Site Scripting in the extensions, settings, permissions and namespaces subpages of ManageWiki

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar ManageWiki

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 6.5epss 0.4%
ManageWiki is a MediaWiki extension allowing users to manage wikis. Special:ManageWiki does not escape escape interface messages on the `columns` and `help` keys on the form descriptor. An attacker may exploit this and would have a cross site scripting attack vector. Exploiting this on-wiki requires the `(editinterface)` right. Users should apply the code changes in commits `886cc6b94`, `2ef0f50880`, and `6942e8b2c` to resolve this vulnerability. There are no known workarounds for this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Produtos afetados
miraheze · ManageWiki
CVEs relacionadas — miraheze ManageWiki

No mesmo produto, das mais perigosas para as menos.

CVE-2021-29483CRITICALwikiconfig API leaked private config variables set through ManageWikiEPSS 1.2%CVE-2025-32956HIGHManageWiki has SQL injection vulnerability in NamespaceMigrationJobEPSS 0.7%CVE-2025-43861MEDIUMManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflectionEPSS 0.3%CVE-2025-32964MEDIUMManageWiki vulnerable to permission bypass when disabling extensions requiring certain permissions in Special:ManageWiki/extensionsEPSS 0.2%