Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1jM2g1LWg3M2MtMjlocc4ABDUX

Mediawiki - DataTransfer Extension Cross-Site Request Forgery (CSRF) and Cross-site Scripting (XSS)

Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects Mediawiki - DataTransfer Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

Permalink: https://github.com/advisories/GHSA-c3h5-h73c-29hq
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jM2g1LWg3M2MtMjlocc4ABDUX
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: 3 days ago
Updated: 3 days ago

EPSS Percentage: 0.00044
EPSS Percentile: 0.12206

Identifiers: GHSA-c3h5-h73c-29hq, CVE-2025-23081
References:

Blast Radius: 1.0

Affected Packages

packagist:mediawiki/data-transfer

Dependent packages: 0
Dependent repositories: 0
Downloads: 11,536 total
Affected Version Ranges: >= 1.42.0, < 1.42.2, >= 1.41.0, < 1.41.3, >= 1.39.0, < 1.39.11
Fixed in: 1.42.2, 1.41.3, 1.39.11
All affected versions:
All unaffected versions: 0.6.2, 1.0.1, 1.1.1, 1.2.1, 1.5.1, 1.6.1