# mediawiki/core (Packagist) vulnerabilities 28 known vulnerabilities (1 critical, 1 high), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/mediawiki/core ## Advisories (28) ### [CVE-2023-45363](https://cve.now/CVE-2023-45363): An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. - Severity: High 7.5 - Published: Oct 9, 2023 - Affected: fixed in 1.35.12; from 1.36.0, fixed in 1.39.5; from 1.40.0, fixed in 1.40.1. ### [CVE-2023-29141](https://cve.now/CVE-2023-29141): An issue was discovered in MediaWiki before 1.35.10, 1.36.x through 1.38.x before 1.38.6, and 1.39.x before 1.39.3. - Severity: Critical 9.8 - Published: Mar 31, 2023 - Affected: from 1.39.0, fixed in 1.39.3; from 1.38.0, fixed in 1.38.6; fixed in 1.35.10. ### [CVE-2021-41800](https://cve.now/CVE-2021-41800): MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). - Severity: Unrated - Published: Oct 11, 2021 - Affected: fixed in 1.36.2. ### [CVE-2020-25813](https://cve.now/CVE-2020-25813): In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users. - Severity: Unrated - Published: Sep 27, 2020 - Affected: from 1.31.0, fixed in 1.31.9; from 1.32.0, fixed in 1.34.3. ### [CVE-2020-25827](https://cve.now/CVE-2020-25827): An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. - Severity: Unrated - Published: Sep 27, 2020 - Affected: from 1.31.0, fixed in 1.31.9; from 1.32.0, fixed in 1.34.3. ### [CVE-2020-25828](https://cve.now/CVE-2020-25828): An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. - Severity: Unrated - Published: Sep 27, 2020 - Affected: from 1.31.0, fixed in 1.31.9; from 1.32.0, fixed in 1.34.3; from 1.35.0-rc.0, fixed in 1.35.0. ### [CVE-2020-25814](https://cve.now/CVE-2020-25814): In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. - Severity: Unrated - Published: Sep 27, 2020 - Affected: from 1.31.0, fixed in 1.31.9; from 1.32.0, fixed in 1.34.3; from 1.35.0-rc.0, fixed in 1.35.0. ### [CVE-2020-25815](https://cve.now/CVE-2020-25815): An issue was discovered in MediaWiki 1.32.x through 1.34.x before 1.34.4. - Severity: Unrated - Published: Sep 27, 2020 - Affected: from 1.32.0, fixed in 1.34.3; from 1.35.0-rc.0, fixed in 1.35.0. ### [CVE-2020-25812](https://cve.now/CVE-2020-25812): An issue was discovered in MediaWiki 1.34.x before 1.34.4. - Severity: Unrated - Published: Sep 27, 2020 - Affected: from 1.34.0, fixed in 1.34.3; from 1.35.0-rc.0, fixed in 1.35.0. ### [CVE-2020-15005](https://cve.now/CVE-2020-15005): In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the… - Severity: Unrated - Published: Jun 24, 2020 - Affected: fixed in 1.31.8; from 1.32.0, fixed in 1.33.4; from 1.34.0, fixed in 1.34.2. ### [CVE-2020-10959](https://cve.now/CVE-2020-10959): resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection… - Severity: Unrated - Published: Jun 2, 2020 - Affected: fixed in 1.34.0-rc.0. ### [CVE-2020-10960](https://cve.now/CVE-2020-10960): In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden… - Severity: Unrated - Published: Apr 3, 2020 - Affected: from 1.31.0, fixed in 1.31.7; from 1.33.0, fixed in 1.33.3; from 1.34.0, fixed in 1.34.1. ### [CVE-2019-19709](https://cve.now/CVE-2019-19709): MediaWiki through 1.33.1 allows attackers to bypass the Title\_blacklist protection mechanism by starting with an arbitrary title… - Severity: Unrated - Published: Dec 11, 2019 - Affected: from 1.31.0, fixed in 1.31.6; from 1.32.0, fixed in 1.32.6; from 1.33.0, fixed in 1.33.2; from 1.33.99, fixed in 1.34.0. ### [CVE-2019-16738](https://cve.now/CVE-2019-16738): In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup. - Severity: Unrated - Published: Sep 26, 2019 - Affected: from 1.31.0, fixed in 1.31.4; from 1.32.0, fixed in 1.32.4; from 1.33.0, fixed in 1.33.1. ### [CVE-2019-12470](https://cve.now/CVE-2019-12470): Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. - Severity: Unrated - Published: Jul 10, 2019 - Affected: from 1.27.0, fixed in 1.27.6; from 1.30.0, fixed in 1.30.2; from 1.31.0, fixed in 1.31.2; from 1.32.0, fixed in 1.32.2. ### [CVE-2019-12469](https://cve.now/CVE-2019-12469): MediaWiki through 1.32.1 has Incorrect Access Control. - Severity: Unrated - Published: Jul 10, 2019 - Affected: from 1.27.0, fixed in 1.27.6; from 1.30.0, fixed in 1.30.2; from 1.31.0, fixed in 1.31.2; from 1.32.0, fixed in 1.32.2. ### [CVE-2019-12474](https://cve.now/CVE-2019-12474): Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak. - Severity: Unrated - Published: Jul 10, 2019 - Affected: from 1.27.0, fixed in 1.27.6; from 1.30.0, fixed in 1.30.2; from 1.31.0, fixed in 1.31.2; from 1.32.0, fixed in 1.32.2. ### [CVE-2019-12472](https://cve.now/CVE-2019-12472): An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. - Severity: Unrated - Published: Jul 10, 2019 - Affected: from 1.18.0, fixed in 1.27.6; from 1.30.0, fixed in 1.30.2; from 1.31.0, fixed in 1.31.2; from 1.32.0, fixed in 1.32.2. ### [CVE-2019-12471](https://cve.now/CVE-2019-12471): Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. - Severity: Unrated - Published: Jul 10, 2019 - Affected: from 1.27.0, fixed in 1.27.6; from 1.30.0, fixed in 1.30.2; from 1.31.0, fixed in 1.31.2. ### [CVE-2019-12473](https://cve.now/CVE-2019-12473): Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. - Severity: Unrated - Published: Jul 10, 2019 - Affected: from 1.27.0, fixed in 1.27.6; from 1.30.0, fixed in 1.30.2; from 1.31.0, fixed in 1.31.2; from 1.32.0, fixed in 1.32.2. ### [CVE-2019-12466](https://cve.now/CVE-2019-12466): Wikimedia MediaWiki through 1.32.1 allows CSRF. - Severity: Unrated - Published: Jul 10, 2019 - Affected: from 1.27.0, fixed in 1.27.6; from 1.30.0, fixed in 1.30.2; from 1.31.0, fixed in 1.31.2; from 1.32.0, fixed in 1.32.2. ### [CVE-2019-12468](https://cve.now/CVE-2019-12468): An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. - Severity: Unrated - Published: Jul 10, 2019 - Affected: from 1.27.0, fixed in 1.27.6; from 1.30.0, fixed in 1.30.2; from 1.31.0, fixed in 1.31.2; from 1.32.0, fixed in 1.32.2. ### [CVE-2019-12467](https://cve.now/CVE-2019-12467): MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3). - Severity: Unrated - Published: Jul 10, 2019 - Affected: fixed in 1.27.6; from 1.30.0, fixed in 1.30.2; from 1.31.0, fixed in 1.31.2; from 1.32.0, fixed in 1.32.2. ### [CVE-2018-13258](https://cve.now/CVE-2018-13258): Tarball was missing .htaccess files - Severity: Unrated - Published: Oct 4, 2018 - Affected: from 1.31.0, fixed in 1.31.1. ### [CVE-2018-0505](https://cve.now/CVE-2018-0505): BotPasswords can bypass CentralAuth's account lock - Severity: Unrated - Published: Oct 4, 2018 - Affected: from 1.27.0, fixed in 1.27.5; from 1.29.0, fixed in 1.29.3; from 1.30.0, fixed in 1.30.1; from 1.31.0, fixed in 1.31.1. ### [CVE-2018-0504](https://cve.now/CVE-2018-0504): Information disclosure in Special:Redirect/logid - Severity: Unrated - Published: Oct 4, 2018 - Affected: from 1.27.0, fixed in 1.27.5; from 1.29.0, fixed in 1.29.3; from 1.30.0, fixed in 1.30.1; from 1.31.0, fixed in 1.31.1. ### [CVE-2018-0503](https://cve.now/CVE-2018-0503): $wgRateLimits entry for 'user' overrides 'newbie' - Severity: Unrated - Published: Oct 4, 2018 - Affected: from 1.27.0, fixed in 1.27.5; from 1.29.0, fixed in 1.29.3; from 1.30.0, fixed in 1.30.1; from 1.31.0, fixed in 1.31.1. ### [CVE-2014-2853](https://cve.now/CVE-2014-2853): Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows… - Severity: Unrated - Published: Apr 29, 2014 - Affected: fixed in 1.21.9; from 1.22.0, fixed in 1.22.6. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/mediawiki/core Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.