CVE-2025-62701
BaseFortify
Publication date: 2025-10-21
Last updated on: 2025-10-21
Assigner: wikimedia-foundation
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| the_wikimedia_foundation | mediawiki | 1.43 |
| the_wikimedia_foundation | mediawiki | 1.44 |
| the_wikimedia_foundation | mediawiki | 1.45.0-alpha |
| the_wikimedia_foundation | mediawiki | master |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-79 | The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users. |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
CVE-2025-62701 is a stored Cross-Site Scripting (XSS) vulnerability in the Wikistories extension of MediaWiki. It occurs because certain system messages are inserted as raw HTML into web pages without proper sanitization. This allows an attacker who can edit these messages to inject malicious HTML or JavaScript code that will be stored and executed in users' browsers when they view affected pages. [1]
How can this vulnerability impact me? :
This vulnerability can allow attackers to execute arbitrary JavaScript in the browsers of users who visit affected pages. This can lead to theft of user credentials, session hijacking, defacement, or other malicious actions performed on behalf of the user without their consent. [1]
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by testing if editable system messages in the Wikistories extension are vulnerable to stored XSS. Specifically, you can attempt to inject a harmless payload such as <img src='' onerror='alert("test")'> into messages like MediaWiki:Wikistories-story-selecttext via the MediaWiki interface. Then, navigate to /wiki/Special:StoryBuilder/Main_Page and observe if the alert triggers, indicating execution of injected script. There are no specific network commands provided, but manual testing through the MediaWiki interface and observing the rendered HTML in the browser's developer tools can help detect the issue. [1]
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation steps include applying the official patch (T400545.patch) that sanitizes and parses system messages before inserting them as HTML, preventing raw injection. Until the patch is applied, restrict editing permissions on the vulnerable system messages (e.g., wikistories-story-selecttext, wikistories-story-edittext-duplicate, wikistories-story-edittext-outdated) to trusted users only to prevent malicious payload injection. Additionally, monitor and review any recent edits to these messages for suspicious content. [1]