CVE-2025-53491
BaseFortify
Publication date: 2025-07-07
Last updated on: 2025-07-08
Assigner: wikimedia-foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a Cross-Site Scripting (XSS) issue in the MediaWiki FlaggedRevs extension, specifically on the Special:PendingChanges page. It occurs because the extension fails to properly escape certain localized message content, allowing attackers to inject malicious scripts via these messages. This improper neutralization of input during web page generation can lead to execution of unauthorized scripts in users' browsers. [1]
How can this vulnerability impact me? :
The vulnerability can allow attackers to execute malicious scripts in the context of users visiting the affected Special:PendingChanges page. This can lead to theft of user credentials, session hijacking, or other malicious actions performed on behalf of the user, compromising the security and integrity of the affected MediaWiki installation. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by checking for improperly escaped messages in the MediaWiki FlaggedRevs extension, especially on the Special:PendingChanges page. The x-xss language tool was used to identify vulnerable message keys such as pendingchanges-diff, pendingchanges-table-watching, and others. While no specific commands are provided, using tools that analyze web application message escaping or scanning for XSS vulnerabilities on the Special:PendingChanges page would be appropriate. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves updating the MediaWiki FlaggedRevs extension to version 1.43.2 or later, where the vulnerability has been fixed by properly escaping rawElement content in the affected message keys. Applying the official patches released by the Wikimedia Foundation and ensuring your installation is up to date will prevent exploitation of this XSS vulnerability. [1]