Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

mediawiki/core

28 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
28 · 1 critical, 1 high
Registry
Packagist

Advisories 28

  • An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1.

    Affected: fixed in 1.35.12; from 1.36.0, fixed in 1.39.5; from 1.40.0, fixed in 1.40.1.

  • CVE-2023-29141Critical 9.8

    An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3.

    Affected: from 1.39.0, fixed in 1.39.3; from 1.38.0, fixed in 1.38.6; fixed in 1.35.10.

  • MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time).

    Affected: fixed in 1.36.2.

  • In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users.

    Affected: from 1.31.0, fixed in 1.31.9; from 1.32.0, fixed in 1.34.3.

  • An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4.

    Affected: from 1.31.0, fixed in 1.31.9; from 1.32.0, fixed in 1.34.3.

  • An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4.

    Affected: from 1.31.0, fixed in 1.31.9; from 1.32.0, fixed in 1.34.3; from 1.35.0-rc.0, fixed in 1.35.0.

  • In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur.

    Affected: from 1.31.0, fixed in 1.31.9; from 1.32.0, fixed in 1.34.3; from 1.35.0-rc.0, fixed in 1.35.0.

  • An issue was discovered in MediaWiki 1.32.x through 1.34.x before 1.34.4.

    Affected: from 1.32.0, fixed in 1.34.3; from 1.35.0-rc.0, fixed in 1.35.0.

  • An issue was discovered in MediaWiki 1.34.x before 1.34.4.

    Affected: from 1.34.0, fixed in 1.34.3; from 1.35.0-rc.0, fixed in 1.35.0.

  • In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the…

    Affected: fixed in 1.31.8; from 1.32.0, fixed in 1.33.4; from 1.34.0, fixed in 1.34.2.

  • resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection…

    Affected: fixed in 1.34.0-rc.0.

  • In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden…

    Affected: from 1.31.0, fixed in 1.31.7; from 1.33.0, fixed in 1.33.3; from 1.34.0, fixed in 1.34.1.

  • MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title…

    Affected: from 1.31.0, fixed in 1.31.6; from 1.32.0, fixed in 1.32.6; from 1.33.0, fixed in 1.33.2; from 1.33.99, fixed in 1.34.0.

  • In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup.

    Affected: from 1.31.0, fixed in 1.31.4; from 1.32.0, fixed in 1.32.4; from 1.33.0, fixed in 1.33.1.

  • Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control.

    Affected: from 1.27.0, fixed in 1.27.6; from 1.30.0, fixed in 1.30.2; from 1.31.0, fixed in 1.31.2; from 1.32.0, fixed in 1.32.2.

Show all 28 advisoriesShow fewer advisories

  • MediaWiki through 1.32.1 has Incorrect Access Control.

    Affected: from 1.27.0, fixed in 1.27.6; from 1.30.0, fixed in 1.30.2; from 1.31.0, fixed in 1.31.2; from 1.32.0, fixed in 1.32.2.

  • Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak.

    Affected: from 1.27.0, fixed in 1.27.6; from 1.30.0, fixed in 1.30.2; from 1.31.0, fixed in 1.31.2; from 1.32.0, fixed in 1.32.2.

  • An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1.

    Affected: from 1.18.0, fixed in 1.27.6; from 1.30.0, fixed in 1.30.2; from 1.31.0, fixed in 1.31.2; from 1.32.0, fixed in 1.32.2.

  • Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS.

    Affected: from 1.27.0, fixed in 1.27.6; from 1.30.0, fixed in 1.30.2; from 1.31.0, fixed in 1.31.2.

  • Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS.

    Affected: from 1.27.0, fixed in 1.27.6; from 1.30.0, fixed in 1.30.2; from 1.31.0, fixed in 1.31.2; from 1.32.0, fixed in 1.32.2.

  • Wikimedia MediaWiki through 1.32.1 allows CSRF.

    Affected: from 1.27.0, fixed in 1.27.6; from 1.30.0, fixed in 1.30.2; from 1.31.0, fixed in 1.31.2; from 1.32.0, fixed in 1.32.2.

  • An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1.

    Affected: from 1.27.0, fixed in 1.27.6; from 1.30.0, fixed in 1.30.2; from 1.31.0, fixed in 1.31.2; from 1.32.0, fixed in 1.32.2.

  • MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3).

    Affected: fixed in 1.27.6; from 1.30.0, fixed in 1.30.2; from 1.31.0, fixed in 1.31.2; from 1.32.0, fixed in 1.32.2.

  • Tarball was missing .htaccess files

    Affected: from 1.31.0, fixed in 1.31.1.

  • BotPasswords can bypass CentralAuth's account lock

    Affected: from 1.27.0, fixed in 1.27.5; from 1.29.0, fixed in 1.29.3; from 1.30.0, fixed in 1.30.1; from 1.31.0, fixed in 1.31.1.

  • Information disclosure in Special:Redirect/logid

    Affected: from 1.27.0, fixed in 1.27.5; from 1.29.0, fixed in 1.29.3; from 1.30.0, fixed in 1.30.1; from 1.31.0, fixed in 1.31.1.

  • $wgRateLimits entry for 'user' overrides 'newbie'

    Affected: from 1.27.0, fixed in 1.27.5; from 1.29.0, fixed in 1.29.3; from 1.30.0, fixed in 1.30.1; from 1.31.0, fixed in 1.31.1.

  • Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows…

    Affected: fixed in 1.21.9; from 1.22.0, fixed in 1.22.6.