by Kastro
Paper/Archive/CVE-2025-12004

CVE-2025-12004

The Wikimedia Foundation Mediawiki - Lockdown Extension — The compare API module breaks Extension:Lockdown

EPSS 0.4%public exploitCVSS 10.0
critical.is priorityof 100
47
CVSS 10.0 (CNA)10.0 / 10 × 3030.0Not in CISA KEV+300.0EPSS percentile 34.4.344 × 206.9Exploit: SSVC poc+1010.0SSVC exploitation: poc+100.0
Description · from the CVE record

Incorrect Permission Assignment for Critical Resource vulnerability in The Wikimedia Foundation Mediawiki - Lockdown Extension allows Privilege Abuse. Fixed in Mediawiki Core Action APIThis issue affects Mediawiki - Lockdown Extension: from master before 1.42.

Affected

ProductAffectedFixed inSource
Mediawiki - Lockdown Extensionmaster – < 1.421.42CNA

Scores by source

wikimedia-foundation (CNA)10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CISA ADPSSVCExploitation: poc · Automatable: yes · Technical impact: total

References

exploitphabricator.wikimedia.org/T397521refgerrit.wikimedia.org/r/q/Id275382743957004fa7fc56318fc104d8e2d267b