CVE-2025-23081

MEDIUM

MediaWiki DataTransfer Extension 1.39.0-1.39.10, 1.41.0-1.41.2, 1.42.0-1.42.1 - CSRF and XSS

Title source: llm
STIX 2.1

Description

Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects Mediawiki - DataTransfer Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

References (7)

Core 7

Scores

CVSS v3 6.1
EPSS 0.0026
EPSS Percentile 49.3%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-352 CWE-79
Status published
Products (4)
mediawiki/data-transfer 1.39.0 - 1.39.11Packagist
Wikimedia Foundation/Mediawiki - DataTransfer Extension 1.39.x - 1.39.11
Wikimedia Foundation/Mediawiki - DataTransfer Extension 1.41.x - 1.41.3
Wikimedia Foundation/Mediawiki - DataTransfer Extension 1.42.x - 1.42.2
Published Jan 14, 2025
Tracked Since Feb 18, 2026