CVE-2025-61647lowCWE-22

CVE-2025-61647: falha de baixa gravidade em Wikimedia Foundation CheckUser

UserInfoCard: Don't allow access to information about users who are suppressed if you don't have suppressor rights

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar CheckUser

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

8Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 0.3epss 0.3%
Vulnerability in Wikimedia Foundation CheckUser. This vulnerability is associated with program files src/Api/Rest/Handler/UserInfoHandler.Php. This issue affects CheckUser: from a3dc1bbcc33acbcca6831d6afaccbb1054c93a57, 0584eb2ad564648aa3ce9c555dd044dda02b55f4.
CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U
Produtos afetados
Wikimedia Foundation · CheckUser
CVEs relacionadas — Wikimedia Foundation CheckUser

No mesmo produto, das mais perigosas para as menos.

CVE-2025-61649LOWUserInfoCard: Check that performing user has permission to view log entries for number of past blocksEPSS 0.4%CVE-2025-67478NONEWrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"EPSS 0.3%CVE-2025-61650LOWUserInfoCard is vulnerable to message key stored XSSEPSS 0.3%CVE-2026-58034NONEStored XSS through a system message when blocking a temporary account that's related to other temporary accountsEPSS 0.3%CVE-2026-34090MEDIUMSuggested investigations: Handle suppressed usernamesEPSS 0.3%CVE-2025-61658LOWSpecial:GlobalContributions shows edits on wikis the viewer doesn't have access toEPSS 0.3%