mediawiki/core (Packagist)

Advisories

Latest version

—

License

—

OpenSSF Scorecard

—

How to fix

Upgrading to 1.40.1 or later clears every advisory below that has a fix.

Upgrade commands

composer

composer require mediawiki/core:^1.40.1

Known vulnerabilities

Advisory	Severity	Affected	Fixed in
GHSA-w5fx-cx7f-6vr9 MediaWiki Denial of Service vulnerability	High EPSS 23.78%	`< 1.35.12`	`1.35.12`
GHSA-w5fx-cx7f-6vr9 MediaWiki Denial of Service vulnerability	High EPSS 23.78%	`>= 1.36.0, < 1.39.5`	`1.39.5`
GHSA-w5fx-cx7f-6vr9 MediaWiki Denial of Service vulnerability	High EPSS 23.78%	`>= 1.40.0, < 1.40.1`	`1.40.1`
GHSA-5vj8-g3qg-4qh6 X-Forwarded-For header allows brute-forcing autoblocked IP addresses	Critical EPSS 1.19%	`>= 1.39.0, < 1.39.3`	`1.39.3`
GHSA-5vj8-g3qg-4qh6 X-Forwarded-For header allows brute-forcing autoblocked IP addresses	Critical EPSS 1.19%	`< 1.35.10`	`1.35.10`
GHSA-5vj8-g3qg-4qh6 X-Forwarded-For header allows brute-forcing autoblocked IP addresses	Critical EPSS 1.19%	`>= 1.38.0, < 1.38.6`	`1.38.6`
GHSA-c8wv-qwwc-6j73 MediaWiki allows a denial of service	Medium EPSS 1.86%	`< 1.36.2`	`1.36.2`
GHSA-h8qx-mj6v-2934 MediaWiki Cross-site Scripting (XSS) vulnerability	Medium EPSS 1.09%	`>= 1.32.0, < 1.34.3`	`1.34.3`
GHSA-h8qx-mj6v-2934 MediaWiki Cross-site Scripting (XSS) vulnerability	Medium EPSS 1.09%	`>= 1.35.0-rc.0, < 1.35.0`	`1.35.0`
GHSA-rqvj-fc2x-99q6 OATHAuth extension in MediaWiki is not implementing rate limit	High EPSS 1.70%	`>= 1.32.0, < 1.34.3`	`1.34.3`
GHSA-2f58-vf6g-6p8x MediaWiki Cross-site Scripting (XSS) vulnerability	Medium EPSS 1.10%	`>= 1.35.0-rc.0, < 1.35.0`	`1.35.0`
GHSA-rqvj-fc2x-99q6 OATHAuth extension in MediaWiki is not implementing rate limit	High EPSS 1.70%	`>= 1.31.0, < 1.31.9`	`1.31.9`
GHSA-4vr7-m8p8-434h MediaWiki Cross-site Scripting (XSS) vulnerability	Medium EPSS 1.35%	`>= 1.31.0, < 1.31.9`	`1.31.9`
GHSA-c4rj-wrmq-52rj MediaWiki Special:UserRights exposes the existence of hidden users	Medium EPSS 1.29%	`>= 1.31.0, < 1.31.9`	`1.31.9`
GHSA-c4rj-wrmq-52rj MediaWiki Special:UserRights exposes the existence of hidden users	Medium EPSS 1.29%	`>= 1.32.0, < 1.34.3`	`1.34.3`
GHSA-4vr7-m8p8-434h MediaWiki Cross-site Scripting (XSS) vulnerability	Medium EPSS 1.35%	`>= 1.32.0, < 1.34.3`	`1.34.3`
GHSA-4vr7-m8p8-434h MediaWiki Cross-site Scripting (XSS) vulnerability	Medium EPSS 1.35%	`>= 1.35.0-rc.0, < 1.35.0`	`1.35.0`
GHSA-h8qx-mj6v-2934 MediaWiki Cross-site Scripting (XSS) vulnerability	Medium EPSS 1.09%	`>= 1.31.0, < 1.31.9`	`1.31.9`
GHSA-2f58-vf6g-6p8x MediaWiki Cross-site Scripting (XSS) vulnerability	Medium EPSS 1.10%	`>= 1.32.0, < 1.34.3`	`1.34.3`
GHSA-rj9p-8jxj-2ch4 MediaWiki Cross-site Scripting (XSS) vulnerability	Medium EPSS 1.10%	`>= 1.34.0, < 1.34.3`	`1.34.3`
GHSA-rj9p-8jxj-2ch4 MediaWiki Cross-site Scripting (XSS) vulnerability	Medium EPSS 1.10%	`>= 1.35.0-rc.0, < 1.35.0`	`1.35.0`
GHSA-xpv7-93cm-4mxv img_auth.php may leak private extension images into the public cache	Medium EPSS 1.30%	`>= 1.34.0, < 1.34.2`	`1.34.2`
GHSA-xpv7-93cm-4mxv img_auth.php may leak private extension images into the public cache	Medium EPSS 1.30%	`< 1.31.8`	`1.31.8`
GHSA-xpv7-93cm-4mxv img_auth.php may leak private extension images into the public cache	Medium EPSS 1.30%	`>= 1.32.0, < 1.33.4`	`1.33.4`
GHSA-mqhw-wq8p-vf5r MediaWiki Open Redirect vulnerability	Medium EPSS 1.43%	`< 1.34.0-rc.0`	`1.34.0-rc.0`
GHSA-pfm2-mqwj-ggm5 MediaWiki makeCollapsible allows applying event handler to any CSS selector	Medium EPSS 1.15%	`>= 1.31.0, < 1.31.7`	`1.31.7`
GHSA-pfm2-mqwj-ggm5 MediaWiki makeCollapsible allows applying event handler to any CSS selector	Medium EPSS 1.15%	`>= 1.33.0, < 1.33.3`	`1.33.3`
GHSA-pfm2-mqwj-ggm5 MediaWiki makeCollapsible allows applying event handler to any CSS selector	Medium EPSS 1.15%	`>= 1.34.0, < 1.34.1`	`1.34.1`
GHSA-pjv5-vv93-p648 Possible to circumvent title-blacklist	Medium EPSS 1.56%	`>= 1.32.0, < 1.32.6`	`1.32.6`
GHSA-pjv5-vv93-p648 Possible to circumvent title-blacklist	Medium EPSS 1.56%	`>= 1.33.0, < 1.33.2`	`1.33.2`
GHSA-pjv5-vv93-p648 Possible to circumvent title-blacklist	Medium EPSS 1.56%	`>= 1.33.99, < 1.34.0`	`1.34.0`
GHSA-pjv5-vv93-p648 Possible to circumvent title-blacklist	Medium EPSS 1.56%	`>= 1.31.0, < 1.31.6`	`1.31.6`
GHSA-7hwr-f745-5rwq MediaWiki information disclosure	Medium EPSS 1.77%	`>= 1.32.0, < 1.32.4`	`1.32.4`
GHSA-7hwr-f745-5rwq MediaWiki information disclosure	Medium EPSS 1.77%	`>= 1.33.0, < 1.33.1`	`1.33.1`
GHSA-7hwr-f745-5rwq MediaWiki information disclosure	Medium EPSS 1.77%	`>= 1.31.0, < 1.31.4`	`1.31.4`
GHSA-2qrr-c2gh-pr35 Wikimedia information leak vulnerability	High EPSS 2.04%	`>= 1.30.0, < 1.30.2`	`1.30.2`
GHSA-2qrr-c2gh-pr35 Wikimedia information leak vulnerability	High EPSS 2.04%	`>= 1.27.0, < 1.27.6`	`1.27.6`
GHSA-2qrr-c2gh-pr35 Wikimedia information leak vulnerability	High EPSS 2.04%	`>= 1.31.0, < 1.31.2`	`1.31.2`
GHSA-2qrr-c2gh-pr35 Wikimedia information leak vulnerability	High EPSS 2.04%	`>= 1.32.0, < 1.32.2`	`1.32.2`
GHSA-27fw-r78j-h898 Wikimedia MediaWiki allows CSRF	High EPSS 0.84%	`>= 1.27.0, < 1.27.6`	`1.27.6`
GHSA-27fw-r78j-h898 Wikimedia MediaWiki allows CSRF	High EPSS 0.84%	`>= 1.30.0, < 1.30.2`	`1.30.2`
GHSA-27fw-r78j-h898 Wikimedia MediaWiki allows CSRF	High EPSS 0.84%	`>= 1.31.0, < 1.31.2`	`1.31.2`
GHSA-27fw-r78j-h898 Wikimedia MediaWiki allows CSRF	High EPSS 0.84%	`>= 1.32.0, < 1.32.2`	`1.32.2`
GHSA-2rm7-xxx8-35jh MediaWiki Cross-site Scripting (XSS)	Medium EPSS 1.29%	`>= 1.27.0, < 1.27.6`	`1.27.6`
GHSA-2rm7-xxx8-35jh MediaWiki Cross-site Scripting (XSS)	Medium EPSS 1.29%	`>= 1.30.0, < 1.30.2`	`1.30.2`
GHSA-2rm7-xxx8-35jh MediaWiki Cross-site Scripting (XSS)	Medium EPSS 1.29%	`>= 1.31.0, < 1.31.2`	`1.31.2`
GHSA-33xw-x3pr-rvqj Wikimedia Potential DOS due to slow WatchedItemStore::countVisitingWatchersMultiple	High EPSS 2.31%	`>= 1.27.0, < 1.27.6`	`1.27.6`
GHSA-33xw-x3pr-rvqj Wikimedia Potential DOS due to slow WatchedItemStore::countVisitingWatchersMultiple	High EPSS 2.31%	`>= 1.30.0, < 1.30.2`	`1.30.2`
GHSA-33xw-x3pr-rvqj Wikimedia Potential DOS due to slow WatchedItemStore::countVisitingWatchersMultiple	High EPSS 2.31%	`>= 1.31.0, < 1.31.2`	`1.31.2`
GHSA-33xw-x3pr-rvqj Wikimedia Potential DOS due to slow WatchedItemStore::countVisitingWatchersMultiple	High EPSS 2.31%	`>= 1.32.0, < 1.32.2`	`1.32.2`
GHSA-733q-m38x-q7cc Wikimedia MediaWik exposed suppressed log in RevisionDelete page	Medium EPSS 1.36%	`>= 1.27.0, < 1.27.6`	`1.27.6`
GHSA-733q-m38x-q7cc Wikimedia MediaWik exposed suppressed log in RevisionDelete page	Medium EPSS 1.36%	`>= 1.30.0, < 1.30.2`	`1.30.2`
GHSA-733q-m38x-q7cc Wikimedia MediaWik exposed suppressed log in RevisionDelete page	Medium EPSS 1.36%	`>= 1.31.0, < 1.31.2`	`1.31.2`
GHSA-733q-m38x-q7cc Wikimedia MediaWik exposed suppressed log in RevisionDelete page	Medium EPSS 1.36%	`>= 1.32.0, < 1.32.2`	`1.32.2`
GHSA-7mqg-5fgh-xh4r MediaWiki Incorrect Access Control vulnerability	High EPSS 1.32%	`>= 1.18.0, < 1.27.6`	`1.27.6`
GHSA-7mqg-5fgh-xh4r MediaWiki Incorrect Access Control vulnerability	High EPSS 1.32%	`>= 1.30.0, < 1.30.2`	`1.30.2`
GHSA-7mqg-5fgh-xh4r MediaWiki Incorrect Access Control vulnerability	High EPSS 1.32%	`>= 1.31.0, < 1.31.2`	`1.31.2`
GHSA-7mqg-5fgh-xh4r MediaWiki Incorrect Access Control vulnerability	High EPSS 1.32%	`>= 1.32.0, < 1.32.2`	`1.32.2`
GHSA-x3fr-w7r5-x7rg MediaWiki Incorrect Access Control vulnerability	Medium EPSS 1.35%	`>= 1.27.0, < 1.27.6`	`1.27.6`
GHSA-x3fr-w7r5-x7rg MediaWiki Incorrect Access Control vulnerability	Medium EPSS 1.35%	`>= 1.30.0, < 1.30.2`	`1.30.2`
GHSA-x3fr-w7r5-x7rg MediaWiki Incorrect Access Control vulnerability	Medium EPSS 1.35%	`>= 1.31.0, < 1.31.2`	`1.31.2`
GHSA-x3fr-w7r5-x7rg MediaWiki Incorrect Access Control vulnerability	Medium EPSS 1.35%	`>= 1.32.0, < 1.32.2`	`1.32.2`
GHSA-wrhx-3pxr-6vgg Wikimedia MediaWiki Incorrect Access Control vulnerability	Critical EPSS 3.33%	`>= 1.30.0, < 1.30.2`	`1.30.2`
GHSA-6vfg-8ppv-h5hg MediaWiki Incorrect Access Control vulnerability	Medium EPSS 1.26%	`< 1.27.6`	`1.27.6`
GHSA-wrhx-3pxr-6vgg Wikimedia MediaWiki Incorrect Access Control vulnerability	Critical EPSS 3.33%	`>= 1.27.0, < 1.27.6`	`1.27.6`
GHSA-wrhx-3pxr-6vgg Wikimedia MediaWiki Incorrect Access Control vulnerability	Critical EPSS 3.33%	`>= 1.31.0, < 1.31.2`	`1.31.2`
GHSA-wrhx-3pxr-6vgg Wikimedia MediaWiki Incorrect Access Control vulnerability	Critical EPSS 3.33%	`>= 1.32.0, < 1.32.2`	`1.32.2`
GHSA-6vfg-8ppv-h5hg MediaWiki Incorrect Access Control vulnerability	Medium EPSS 1.26%	`>= 1.32.0, < 1.32.2`	`1.32.2`
GHSA-6vfg-8ppv-h5hg MediaWiki Incorrect Access Control vulnerability	Medium EPSS 1.26%	`>= 1.31.0, < 1.31.2`	`1.31.2`
GHSA-6vfg-8ppv-h5hg MediaWiki Incorrect Access Control vulnerability	Medium EPSS 1.26%	`>= 1.30.0, < 1.30.2`	`1.30.2`
GHSA-6h86-9r5g-f2h5 Cross-site scripting vulnerability in includes/actions/InfoAction.php	Medium EPSS 2.39%	`< 1.21.9`	`1.21.9`
GHSA-6h86-9r5g-f2h5 Cross-site scripting vulnerability in includes/actions/InfoAction.php	Medium EPSS 2.39%	`>= 1.22.0, < 1.22.6`	`1.22.6`
GHSA-2c28-7gwv-cpgf Mediawiki tarball is missing .htaccess files	Medium EPSS 2.25%	`>= 1.31.0, < 1.31.1`	`1.31.1`
GHSA-mhfv-9h99-jwg7 Mediawiki Improper Privilege Management	Medium EPSS 1.56%	`>= 1.27.0, < 1.27.5`	`1.27.5`
GHSA-mhfv-9h99-jwg7 Mediawiki Improper Privilege Management	Medium EPSS 1.56%	`>= 1.31.0, < 1.31.1`	`1.31.1`
GHSA-mhfv-9h99-jwg7 Mediawiki Improper Privilege Management	Medium EPSS 1.56%	`>= 1.30.0, < 1.30.1`	`1.30.1`
GHSA-mhfv-9h99-jwg7 Mediawiki Improper Privilege Management	Medium EPSS 1.56%	`>= 1.29.0, < 1.29.3`	`1.29.3`
GHSA-5c6w-f4w2-2grp Mediawiki BotPassword can bypass CentralAuth's account lock	Medium EPSS 1.97%	`>= 1.31.0, < 1.31.1`	`1.31.1`
GHSA-5c6w-f4w2-2grp Mediawiki BotPassword can bypass CentralAuth's account lock	Medium EPSS 1.97%	`>= 1.30.0, < 1.30.1`	`1.30.1`
GHSA-5c6w-f4w2-2grp Mediawiki BotPassword can bypass CentralAuth's account lock	Medium EPSS 1.97%	`>= 1.29.0, < 1.29.3`	`1.29.3`
GHSA-5c6w-f4w2-2grp Mediawiki BotPassword can bypass CentralAuth's account lock	Medium EPSS 1.97%	`>= 1.27.0, < 1.27.5`	`1.27.5`
GHSA-hr8v-f4g2-p66f Mediawiki information disclosure vulnerability	Medium EPSS 2.88%	`>= 1.31.0, < 1.31.1`	`1.31.1`
GHSA-hr8v-f4g2-p66f Mediawiki information disclosure vulnerability	Medium EPSS 2.88%	`>= 1.27.0, < 1.27.5`	`1.27.5`
GHSA-hr8v-f4g2-p66f Mediawiki information disclosure vulnerability	Medium EPSS 2.88%	`>= 1.30.0, < 1.30.1`	`1.30.1`
GHSA-hr8v-f4g2-p66f Mediawiki information disclosure vulnerability	Medium EPSS 2.88%	`>= 1.29.0, < 1.29.3`	`1.29.3`

Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor