« Volver al listado

CVE-2025-53489

Estado: AnalizadaMedia (5.6)—

Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - GoogleDocs4MW Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - GoogleDocs4MW Extension: from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Jackphoenix — Googledocs4mw

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2025-53489",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2025-53489",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2025-07-03T17:57:10.981383Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.6,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
          "integrityImpact": "LOW",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "LOW",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 3.4,
        "exploitabilityScore": 2.2
      }
    ]
  },
  "affected": [
    {
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
      "affectedData": [
        {
          "vendor": "Wikimedia Foundation",
          "product": "Mediawiki - GoogleDocs4MW Extension",
          "versions": [
            {
              "status": "affected",
              "version": "1.42.x",
              "lessThan": "1.42.7",
              "versionType": "semver"
            },
            {
              "status": "affected",
              "version": "1.43.x",
              "lessThan": "1.43.2",
              "versionType": "semver"
            }
          ],
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2025-07-03T17:15:39.850",
  "references": [
    {
      "url": "https://gerrit.wikimedia.org/r/c/mediawiki/extensions/GoogleDocs4MW/+/1155269",
      "tags": [
        "Patch"
      ],
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
    },
    {
      "url": "https://phabricator.wikimedia.org/T395949",
      "tags": [
        "Issue Tracking",
        "Patch"
      ],
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
    }
  ],
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Wikimedia Foundation Mediawiki - GoogleDocs4MW Extension allows Cross-Site Scripting (XSS).This issue affects Mediawiki - GoogleDocs4MW Extension: from 1.42.X before 1.42.7, from 1.43.X before 1.43.2."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de neutralización incorrecta de la entrada durante la generación de páginas web (XSS o 'Cross-site Scripting') en Wikimedia Foundation Mediawiki - GoogleDocs4MW Extension permite Cross-Site Scripting (XSS). Este problema afecta a la extensión Mediawiki - GoogleDocs4MW: desde 1.42.X hasta 1.42.7, desde 1.43.X hasta 1.43.2."
    }
  ],
  "lastModified": "2026-06-17T09:38:18.450",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:jackphoenix:googledocs4mw:-:*:*:*:*:mediawiki:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4AC64F3B-496E-4678-BB86-FF9F0DB41FBA"
            }
          ],
          "operator": "OR"
        },
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "F36D7977-01B4-4FA4-B66E-7D2A56B3460F",
              "versionEndExcluding": "1.42.7",
              "versionStartIncluding": "1.42.0"
            },
            {
              "criteria": "cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*",
              "vulnerable": false,
              "matchCriteriaId": "FF68522C-79EA-4968-BE57-9847C8B4351E",
              "versionEndExcluding": "1.43.2",
              "versionStartIncluding": "1.43.0"
            }
          ],
          "operator": "OR"
        }
      ],
      "operator": "AND"
    }
  ],
  "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"
}