GHSA-c3h5-h73c-29hqMedium

Mediawiki - DataTransfer Extension Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS)

Published
January 14, 2025
Last Modified
January 14, 2025

🔗 CVE IDs covered (1)

CVE-2025-23081 →

📋 Description

Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects Mediawiki - DataTransfer Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

🎯 Affected products3

  • composer/mediawiki/data-transfer:>= 1.39.0, < 1.39.11
  • composer/mediawiki/data-transfer:>= 1.41.0, < 1.41.3
  • composer/mediawiki/data-transfer:>= 1.42.0, < 1.42.2

🔗 References (9)