AbuseFilter Extension up to 1.39.12/1.42.6/1.43.1 on Mediawiki authorization

Summaryinfo

A vulnerability labeled as critical has been found in AbuseFilter Extension up to 1.39.12/1.42.6/1.43.1 on Mediawiki. The impacted element is an unknown function. The manipulation results in authorization. This vulnerability is cataloged as CVE-2025-53499. The attack may be launched remotely. There is no exploit available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical has been found in AbuseFilter Extension up to 1.39.12/1.42.6/1.43.1 on Mediawiki. Affected is an unknown part. The manipulation with an unknown input leads to a authorization vulnerability. CWE is classifying the issue as CWE-862. The product does not perform an authorization check when an actor attempts to access a resource or perform an action. The impact remains unknown. CVE summarizes:

: Missing Authorization vulnerability in Wikimedia Foundation Mediawiki - AbuseFilter Extension allows Unauthorized Access.This issue affects Mediawiki - AbuseFilter Extension: from 1.39.X before 1.39.13, from 1.42.X before 1.42.7, from 1.43.X before 1.43.2.

The weakness was shared by Dreamy_Jazz. The advisory is available at phabricator.wikimedia.org. This vulnerability is traded as CVE-2025-53499 since 06/30/2025. The exploitability is told to be easy. It is possible to launch the attack remotely. The technical details are unknown and an exploit is not available.

Upgrading to version 1.39.13, 1.42.7 or 1.43.2 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at EUVD (EUVD-2025-20313). If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Name

• AbuseFilter Extension

Version

• 1.39.0
• 1.39.1
• 1.39.2
• 1.39.3
• 1.39.4
• 1.39.5
• 1.39.6
• 1.39.7
• 1.39.8
• 1.39.9
• 1.39.10
• 1.39.11
• 1.39.12
• 1.42.0
• 1.42.1
• 1.42.2
• 1.42.3
• 1.42.4
• 1.42.5
• 1.42.6
• 1.43.0
• 1.43.1

CPE 2.3info

• 🔒
• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion