« Volver al listado

CVE-2025-23081

Estado: AplazadaMedia (6.1)—

Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects Mediawiki - DataTransfer Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

⚠ Inferidas por IA a partir de la descripción — NVD aún no ha analizado esta CVE; no son CPE verificados.

Wikimedia — Mediawiki Datatransfer ExtensionAI

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-23081",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-23081",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-01-16T15:35:39.419422Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 6.1,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
      "affectedData": [
        {
          "vendor": "Wikimedia Foundation",
          "product": "Mediawiki - DataTransfer Extension",
          "versions": [
            {
              "status": "affected",
              "version": "1.39.x",
              "lessThan": "1.39.11",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.41.x",
              "lessThan": "1.41.3",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.42.x",
              "lessThan": "1.42.2",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-01-14T17:15:21.750",
  "references": [
    {
      "url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1080451",
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
    },
    {
      "url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/DataTransfer/+/1093931",
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
    },
    {
      "url": "https://gerrit.wikimedia.org/r/q/I5e1538a3bf66378810f905834c05626e1d2c82f0",
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
    },
    {
      "url": "https://gerrit.wikimedia.org/r/q/I773c616db781d2f3f30893ad01ef503bf251a2b3",
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
    },
    {
      "url": "https://gerrit.wikimedia.org/r/q/I7c9de4c8dcdb3276ba923c6bc7c8eef3531324c7",
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
    },
    {
      "url": "https://gerrit.wikimedia.org/r/q/I9223c31f02f31f1e06e1a8cddf7d539cc8d3a3d9",
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
    },
    {
      "url": "https://phabricator.wikimedia.org/T379749",
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
    }
  ],
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        },
        {
          "lang": "en",
          "value": "CWE-352"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Cross-Site Request Forgery (CSRF), Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - DataTransfer Extension allows Cross Site Request Forgery, Cross-Site Scripting (XSS).This issue affects Mediawiki - DataTransfer Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2."
    },
    {
      "lang": "es",
      "value": "Cross-Site Request Forgery (CSRF), vulnerabilidad de neutralización inadecuada de la entrada durante la generación de páginas web (XSS o 'Cross-site Scripting') en Mediawiki - DataTransfer Extension de Wikimedia Foundation permite Cross Site Request Forgery y Cross-Site Scripting (XSS). Este problema afecta a Mediawiki - DataTransfer Extension: desde 1.39.X hasta 1.39.11, desde 1.41.X hasta 1.41.3, desde 1.42.X hasta 1.42.2."
    }
  ],
  "lastModified": "2026-06-17T08:51:51.590",
  "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
}