MediaWiki
Page 3 of 5 — MediaWiki CVEs from a corpus of 466, newest first, with CVSS severity and publication dates.
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2021-36126 | Critical | 9.8 | 2021-07-02 | An issue was discovered in the AbuseFilter extension in MediaWiki through 1.36. If the MediaWiki:Abusefilter-blocker message is invalid within the content lang… |
CVE-2021-36125 | High | 7.5 | 2021-07-02 | An issue was discovered in the CentralAuth extension in MediaWiki through 1.36. The Special:GlobalRenameRequest page is vulnerable to infinite loops and denial… |
CVE-2021-35197 | High | 7.5 | 2021-07-02 | In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "… |
CVE-2021-31555 | High | 7.5 | 2021-04-22 | An issue was discovered in the Oauth extension for MediaWiki through 1.35.2. It did not validate the oarc_version (aka oauth_registered_consumer.oarc_version)… |
CVE-2021-31554 | Medium | 5.4 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It improperly handled account blocks for certain automatically created Media… |
CVE-2021-31553 | Medium | 6.5 | 2021-04-22 | An issue was discovered in the CheckUser extension for MediaWiki through 1.35.2. MediaWiki usernames with trailing whitespace could be stored in the cu_log dat… |
CVE-2021-31552 | Medium | 5.4 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly executed certain rules related to blocking accounts after acc… |
CVE-2021-31551 | Medium | 6.1 | 2021-04-22 | An issue was discovered in the PageForms extension for MediaWiki through 1.35.2. Crafted payloads for Token-related query parameters allowed for XSS on certain… |
CVE-2021-31550 | Medium | 5.4 | 2021-04-22 | An issue was discovered in the CommentBox extension for MediaWiki through 1.35.2. Via crafted configuration variables, a malicious actor could introduce XSS pa… |
CVE-2021-31549 | Medium | 4.3 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The Special:AbuseFilter/examine form allowed for the disclosure of suppresse… |
CVE-2021-31548 | Medium | 6.5 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. A MediaWiki user who is partially blocked or was unsuccessfully blocked coul… |
CVE-2021-31547 | Medium | 4.3 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. Its AbuseFilterCheckMatch API reveals suppressed edits and usernames to unpr… |
CVE-2021-31546 | Medium | 4.3 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. It incorrectly logged sensitive suppression deletions, which should not have… |
CVE-2021-31545 | Medium | 5.3 | 2021-04-22 | An issue was discovered in the AbuseFilter extension for MediaWiki through 1.35.2. The page_recent_contributors leaked the existence of certain deleted MediaWi… |
CVE-2021-30159 | Medium | 4.3 | 2021-04-09 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Users can bypass intended restrictions on deleting pages in certai… |
CVE-2021-30156 | Medium | 4.3 | 2021-04-09 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Special:Contributions can leak that a "hidden" user exists. |
CVE-2021-30155 | Medium | 4.3 | 2021-04-09 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. ContentModelChange does not check if a user has correct permission… |
CVE-2021-30152 | Medium | 4.3 | 2021-04-09 | An issue was discovered in MediaWiki before 1.31.13 and 1.32.x through 1.35.x before 1.35.2. When using the MediaWiki API to "protect" a page, a user is curren… |
CVE-2021-30158 | Medium | 5.3 | 2021-04-06 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. Blocked users are unable to use Special:ResetTokens. This has secu… |
CVE-2021-30157 | Medium | 6.1 | 2021-04-06 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On ChangesList special pages such as Special:RecentChanges and Spe… |
CVE-2021-30154 | Medium | 6.1 | 2021-04-06 | An issue was discovered in MediaWiki before 1.31.12 and 1.32.x through 1.35.x before 1.35.2. On Special:NewFiles, all the mediastatistics-header-* messages are… |
CVE-2020-29005 | High | 7.5 | 2021-01-29 | The API in the Push extension for MediaWiki through 1.35 used cleartext for ApiPush credentials, allowing for potential information disclosure. |
CVE-2020-29004 | High | 8.8 | 2021-01-29 | The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF attack. |
CVE-2020-35626 | High | 8.8 | 2020-12-21 | An issue was discovered in the PushToWatch extension for MediaWiki through 1.35.1. The primary form did not implement an anti-CSRF token and therefore was comp… |
CVE-2020-35625 | High | 8.8 | 2020-12-21 | An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the ability to edit pages within the Widgets namespace could call… |
CVE-2020-35624 | Medium | 5.3 | 2020-12-21 | An issue was discovered in the SecurePoll extension for MediaWiki through 1.35.1. The non-admin vote list contains a full vote timestamp, which may provide uni… |
CVE-2020-35623 | High | 7.5 | 2020-12-21 | An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial… |
CVE-2020-35622 | Medium | 6.1 | 2020-12-21 | An issue was discovered in the GlobalUsage extension for MediaWiki through 1.35.1. SpecialGlobalUsage.php calls WikiMap::makeForeignLink unsafely. The $page va… |
CVE-2020-35480 | Medium | 5.3 | 2020-12-18 | An issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don't exist) and hidden users (accounts that have been explicitly hidden due t… |
CVE-2020-35479 | Medium | 6.1 | 2020-12-18 | MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. Language::translateBlockExpiry itself does not escape in all code paths. For example, the return… |
CVE-2020-35478 | Medium | 6.1 | 2020-12-18 | MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. MediaWiki:blanknamespace potentially can be output as raw HTML with SCRIPT tags via LogFormatter… |
CVE-2020-35477 | Medium | 5.3 | 2020-12-18 | MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpage to Special:MyLanguage/Main Page, visi… |
CVE-2020-35475 | High | 7.5 | 2020-12-18 | In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS can happen when a user visits Special:U… |
CVE-2020-35474 | Medium | 6.1 | 2020-12-18 | In MediaWiki before 1.35.1, the combination of Html::rawElement and Message::text leads to XSS because the definition of MediaWiki:recentchanges-legend-watchli… |
CVE-2020-29003 | Medium | 5.4 | 2020-11-24 | The PollNY extension for MediaWiki through 1.35 allows XSS via an answer option for a poll question, entered during Special:CreatePoll or Special:UpdatePoll. |
CVE-2020-29002 | Medium | 4.8 | 2020-11-24 | includes/CologneBlueTemplate.php in the CologneBlue skin for MediaWiki through 1.35 allows XSS via a qbfind message supplied by an administrator. |
CVE-2020-27957 | Medium | 5.4 | 2020-10-28 | The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data. When certain varieties of games were created with… |
CVE-2020-27621 | Medium | 4.3 | 2020-10-22 | The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. Instead, for various… |
CVE-2020-27620 | Medium | 6.1 | 2020-10-22 | The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped. This is related to wfMessage and Html… |
CVE-2020-26121 | High | 7.5 | 2020-09-27 | An issue was discovered in the FileImporter extension for MediaWiki before 1.34.4. An attacker can import a file even when the target page is protected against… |
CVE-2020-26120 | Medium | 6.1 | 2020-09-27 | XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGatewa… |
CVE-2020-25869 | High | 7.5 | 2020-09-27 | An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the corre… |
CVE-2020-25828 | Medium | 6.1 | 2020-09-27 | An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape H… |
CVE-2020-25827 | High | 7.5 | 2020-09-27 | An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/clust… |
CVE-2020-25815 | Medium | 6.1 | 2020-09-27 | An issue was discovered in MediaWiki 1.32.x through 1.34.x before 1.34.4. LogEventList::getFiltersDesc is insecurely using message text to build options names… |
CVE-2020-25814 | Medium | 6.1 | 2020-09-27 | In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. The attacker creates a message with [javascript:payload x… |
CVE-2020-25813 | Medium | 5.3 | 2020-09-27 | In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users. |
CVE-2020-25812 | Medium | 6.1 | 2020-09-27 | An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTM… |
CVE-2020-15005 | Low | 3.1 | 2020-06-24 | In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image autho… |
CVE-2020-10959 | Medium | 6.1 | 2020-06-02 | resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via HTML content in a M… |
CVE-2020-12051 | High | 7.5 | 2020-04-21 | The CentralAuth extension through REL1_34 for MediaWiki allows remote attackers to obtain sensitive hidden account information via an api.php?action=query&meta… |
CVE-2020-10960 | Medium | 5.3 | 2020-04-03 | In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface)… |
CVE-2019-16528 | High | 7.5 | 2020-03-20 | An issue was discovered in the AbuseFilter extension for MediaWiki. includes/special/SpecialAbuseLog.php allows attackers to obtain sensitive information, such… |
CVE-2019-16529 | Medium | 5.3 | 2020-03-19 | An issue was discovered in the CheckUser extension through 1.35.0 for MediaWiki. Oversighted edit summaries are still visible in CheckUser results in violation… |
CVE-2019-15124 | Medium | 6.1 | 2020-03-19 | In the MobileFrontend extension for MediaWiki, XSS exists within the edit summary field of the watchlist feed. This affects REL1_31, REL1_32, and REL1_33. |
CVE-2020-10534 | Critical | 9.8 | 2020-03-12 | In the GlobalBlocking extension before 2020-03-10 for MediaWiki through 1.34.0, an issue related to IP range evaluation resulted in blocked users re-gaining es… |
CVE-2012-4381 | High | 8.1 | 2020-02-08 | MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves passwords in the local database, (1) which could make it easier for context-dependent attackers to obta… |
CVE-2013-4572 | High | 7.5 | 2020-02-06 | The CentralNotice extension for MediaWiki before 1.19.9, 1.20.x before 1.20.8, and 1.21.x before 1.21.3 sets the Cache-Control header to cache session cookies… |
CVE-2013-6455 | Medium | 5.3 | 2020-01-28 | The CentralAuth extension for MediaWiki before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to obtain usernames via vectors re… |
CVE-2013-6451 | Medium | 6.1 | 2020-01-28 | Cross-site scripting (XSS) vulnerability in MediaWiki 1.19.9 before 1.19.10, 1.2x before 1.21.4, and 1.22.x before 1.22.1 allows remote attackers to inject arb… |
CVE-2014-9481 | Medium | 5.9 | 2020-01-27 | The Scribunto extension for MediaWiki allows remote attackers to obtain the rollback token and possibly other sensitive information via a crafted module, relat… |
CVE-2020-6163 | Medium | 6.1 | 2020-01-08 | The WikibaseMediaInfo extension 1.35 for MediaWiki allows XSS because of improper template syntax within the PropertySuggestionsWidget template (in the templat… |
CVE-2019-19910 | Medium | 6.1 | 2019-12-19 | The MinervaNeue Skin in MediaWiki from 2019-11-05 to 2019-12-13 (1.35 and/or 1.34) mishandles certain HTML attributes, as demonstrated by IMG onmouseover= (imp… |
CVE-2013-4303 | Medium | 6.1 | 2019-12-11 | includes/libs/IEUrlExtension.php in the MediaWiki API in MediaWiki 1.19.x before 1.19.8, 1.20.x before 1.20.7, and 1.21.x before 1.21.2 does not properly detec… |
CVE-2019-19709 | Medium | 6.1 | 2019-12-11 | MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable… |
CVE-2019-19708 | Medium | 6.1 | 2019-12-11 | The VisualEditor extension through 1.34 for MediaWiki allows XSS via pasted content containing an element with a data-ve-clipboard-key attribute. |
CVE-2013-1817 | High | 7.5 | 2019-11-20 | MediaWiki before 1.19.4 and 1.20.x before 1.20.3 contains an error in the api.php script which allows remote attackers to obtain sensitive information. |
CVE-2013-1816 | High | 7.5 | 2019-11-20 | MediaWiki before 1.19.4 and 1.20.x before 1.20.3 allows remote attackers to cause a denial of service (application crash) by sending a specially crafted reques… |
CVE-2019-18987 | Medium | 5.3 | 2019-11-15 | An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Once a specific abuse filter has (accidentally or otherwise) been made public… |
CVE-2013-1951 | Medium | 6.1 | 2019-10-31 | A cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.5 and 1.20.x before 1.20.4 and allows remote attackers to inject arbitrary web script or HT… |
CVE-2019-18612 | Medium | 5.3 | 2019-10-29 | An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Previously hidden (restricted) AbuseFilter filters were viewable (or their dif… |
CVE-2019-18611 | Medium | 6.5 | 2019-10-29 | An issue was discovered in the CheckUser extension through 1.34 for MediaWiki. Certain sensitive information within oversighted edit summaries made available v… |
CVE-2012-0046 | High | 7.5 | 2019-10-29 | mediawiki allows deleted text to be exposed |
CVE-2019-16738 | Medium | 5.3 | 2019-09-26 | In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup. |
CVE-2019-14807 | Medium | 6.1 | 2019-08-09 | In the MobileFrontend extension 1.31 through 1.33 for MediaWiki, XSS exists within the edit summary field in includes/specials/MobileSpecialPageFeed.php. |
CVE-2019-12470 | Medium | 6.5 | 2019-07-10 | Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. |
CVE-2019-12469 | Medium | 6.5 | 2019-07-10 | MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6. |
CVE-2019-12474 | High | 7.5 | 2019-07-10 | Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak. Privileged API responses that include whether a recent change has been patrolled may be cach… |
CVE-2019-12473 | High | 7.5 | 2019-07-10 | Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in… |
CVE-2019-12472 | High | 7.5 | 2019-07-10 | An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBl… |
CVE-2019-12471 | Medium | 6.1 | 2019-07-10 | Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on… |
CVE-2019-12466 | High | 8.8 | 2019-07-10 | Wikimedia MediaWiki through 1.32.1 allows CSRF. |
CVE-2019-12468 | Critical | 9.8 | 2019-07-10 | An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypas… |
CVE-2019-12467 | Medium | 5.3 | 2019-07-10 | MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3). A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability t… |
CVE-2018-13258 | Medium | 5.3 | 2018-10-04 | Mediawiki 1.31 before 1.31.1 misses .htaccess files in the provided tarball used to protect some directories that shouldn't be web accessible. |
CVE-2018-0505 | Medium | 6.5 | 2018-10-04 | Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where BotPasswords can bypass CentralAuth's account lock |
CVE-2018-0504 | Medium | 6.5 | 2018-10-04 | Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains an information disclosure flaw in the Special:Redirect/logid |
CVE-2018-0503 | Medium | 4.3 | 2018-10-04 | Mediawiki 1.31 before 1.31.1, 1.30.1, 1.29.3 and 1.27.5 contains a flaw where contrary to the documentation, $wgRateLimits entry for 'user' overrides that for… |
CVE-2014-1686 | Medium | 5.3 | 2018-04-16 | MediaWiki 1.18.0 allows remote attackers to obtain the installation path via vectors related to thumbnail creation. |
CVE-2017-0372 | Critical | 9.8 | 2018-04-13 | Parameters injection in the SyntaxHighlight extension of Mediawiki before 1.23.16, 1.27.3 and 1.28.2 might result in multiple vulnerabilities. |
CVE-2017-0370 | Medium | 5.3 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw were Spam blacklist is ineffective on encoded URLs inside file inclusion syntax's link parameter. |
CVE-2017-0369 | Medium | 6.5 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw, allowing a sysops to undelete pages, although the page is protected against it. |
CVE-2017-0368 | Medium | 5.3 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw making rawHTML mode apply to system messages. |
CVE-2017-0367 | High | 8.8 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 contains an unsafe use of temporary directory, where having LocalisationCache directory default to system tmp directory is ins… |
CVE-2017-0366 | Medium | 5.4 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw allowing to evade SVG filter using default attribute values in DTD declaration. |
CVE-2017-0365 | Medium | 4.7 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a XSS vulnerability in SearchHighlighter::highlightText() with non-default configurations. |
CVE-2017-0364 | Medium | 6.1 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where Special:Search allows redirects to any interwiki link. |
CVE-2017-0363 | Medium | 6.1 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 has a flaw where Special:UserLogin?returnto=interwiki:foo will redirect to external sites. |
CVE-2017-0362 | High | 8.8 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains a flaw where the "Mark all pages visited" on the watchlist does not require a CSRF token. |
CVE-2017-0361 | High | 7.8 | 2018-04-13 | Mediawiki before 1.28.1 / 1.27.2 / 1.23.16 contains an information disclosure flaw, where the api.log might contain passwords in plaintext. |