TI-2024-16564 Aliases CVE-2024-25109

Cross-Site Scripting in the extensions, settings, permissions and namespaces subpages of ManageWiki

LOW 29CWE-79Published 2024-02-09 · Updated 2024-08-01

Key facts

Attack vector: Network
Privileges required: High
User interaction: None
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: High · High · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-79.

Summary

ManageWiki is a MediaWiki extension allowing users to manage wikis. Special:ManageWiki does not escape escape interface messages on the `columns` and `help` keys on the form descriptor. An attacker may exploit this and would have a cross site scripting attack vector. Exploiting this on-wiki requires the `(editinterface)` right. Users should apply the code changes in commits `886cc6b94`, `2ef0f50880`, and `6942e8b2c` to resolve this vulnerability. There are no known workarounds for this vulnerability.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00448 39th percentileScored 2026-11-07

Fix Fixed ManageWiki (miraheze): 6942e8b2c01dc33c2c41a471f91ef3f6ca726073

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
miraheze	ManageWiki	before 6942e8b2c01dc33c2c41a471f91ef3f6ca726073	6942e8b2c01dc33c2c41a471f91ef3f6ca726073	Patch available	CNA

ManageWiki Vendormiraheze Affected before 6942e8b2c01dc33c2c41a471f91ef3f6ca726073 Fixed in 6942e8b2c01dc33c2c41a471f91ef3f6ca726073 Patch available CNA

CPE configurations NVD · 1

CPE	Versions	Role	Vendor
cpe:2.3:a:miraheze:managewiki::::::::	before 2024-02-09	Vulnerable	miraheze

cpe:2.3:a:miraheze:managewiki:*:*:*:*:*:*:*:* Versions before 2024-02-09 Vulnerable ·miraheze

Remediation

Fix · CNA ManageWiki (miraheze) Fixed in 6942e8b2c01dc33c2c41a471f91ef3f6ca726073

Timeline

2026-10-02 Threatist record created from CVE-2024-25109

References

Patch 3

Advisory 1

https://github.com/miraheze/ManageWiki/security/advisories/GHSA-4jr2-jhfm-2r84

Other 1

https://issue-tracker.miraheze.org/T11812

TI-2021-10196 wikiconfig API leaked private config variables set through ManageWiki CVSS 3.1CRITICAL 9.4
TI-2025-23966 ManageWiki has SQL injection vulnerability in NamespaceMigrationJob CVSS 3.1HIGH 8.0
TI-2025-28445 ManageWiki Vulnerable to Self-XSS in review dialog via unsanitized field reflection CVSS 3.1MEDIUM 5.4
TI-2025-23974 Improper authorization in miraheze ManageWiki CVSS 3.1MEDIUM 4.6

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences