The CheckUser extension’s Special:CheckUser interface is vulnerable to reflected XSS via the rev-deleted-user message. This message is rendered without proper escaping, making it possible to inject JavaScript through the uselang=x-xss language override mechanism.
This issue affects Mediawiki - CheckUser extension: from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.
References
Configurations
No configuration.
History
10 Jul 2025, 14:15
Type | Values Removed | Values Added |
---|---|---|
References | () https://phabricator.wikimedia.org/T394693 - | |
CVSS |
v2 : v3 : |
v2 : unknown
v3 : 5.4 |
09 Jul 2025, 11:15
Type | Values Removed | Values Added |
---|---|---|
Summary |
|
|
Summary | (en) The CheckUser extension’s Special:CheckUser interface is vulnerable to reflected XSS via the rev-deleted-user message. This message is rendered without proper escaping, making it possible to inject JavaScript through the uselang=x-xss language override mechanism. This issue affects Mediawiki - CheckUser extension: from 1.42.X before 1.42.7, from 1.43.X before 1.43.2. |
08 Jul 2025, 18:15
Type | Values Removed | Values Added |
---|---|---|
New CVE |
Information
Published : 2025-07-08 18:15
Updated : 2025-07-10 14:15
NVD link : CVE-2025-53479
Mitre link : CVE-2025-53479
CVE.ORG link : CVE-2025-53479
JSON object : View
Products Affected
No product.
CWE
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')