SB2025080752 - Debian update for mediawiki
Published: August 7, 2025
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 8 secuirty vulnerabilities.
1) Improper access control (CVE-ID: CVE-2025-6590)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper validation of the usernames. A logged-out user can reveal hidden page contents through transclusion, e.g., "{{:Private page}}".
2) Text injection (CVE-ID: CVE-2025-6591)
The vulnerability allows a remote attacker to display arbitrary text output.
The vulnerability exists due to insufficient validation of user-supplied input on the API "action=feedcontributions" output. A remote attacker can inject and display arbitrary text messages in the API output.
3) Information disclosure (CVE-ID: CVE-2025-6593)
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to the application does not verify the email address when sending the "{{SITENAME}} registered email address has been changed" email message, revealing the IP address of the user. A remote attacker can gain access to sensitive information.
4) Cross-site scripting (CVE-ID: CVE-2025-6594)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in Special:ApiSandbox. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
5) Stored cross-site scripting (CVE-ID: CVE-2025-6595)
The disclosed vulnerability allows a remote user to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in MultimediaViewer. A remote user can inject and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.
6) Improper authentication (CVE-ID: CVE-2025-6597)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to logic error in the autocreation process, which shares its logic with the user login flow via the AuthManager::setSessionDataForUser() method. A remote attacker can bypass authentication process and take over accounts of other web application users.
7) Improper authentication (CVE-ID: CVE-2025-6926)
The vulnerability allows a remote attacker to bypass authentication process.
The vulnerability exists due to an error in the authentication logic when using SUL3 autologin for re-authentication. A remote attacker can bypass authentication process and gain unauthorized access to the application.
8) Cross-site scripting (CVE-ID: CVE-2025-32072)
The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.
The vulnerability exists due to insufficient sanitization of user-supplied data in Feed Utils. A remote attacker can inject and execute arbitrary JavaScript code in WebView.
Remediation
Install update from vendor's website.