CVE-2025-25287: XSS
First published: Thu Feb 13 2025(Updated: )
Lakeus is a simple skin made for MediaWiki. Starting in version 1.8.0 and prior to versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0, Lakeus is vulnerable to store cross-site scripting via malicious system messages, though editing the messages requires high privileges. Those with `(editinterface)` rights can edit system messages that are improperly handled in order to send raw HTML. In the case of `lakeus-footermessage`, this will affect all users if the server is configured to link back to this repository. Otherwise, the system messages in themeDesigner.js are only used when the user enables it in their preferences. Versions 1.3.1+REL1.39, 1.3.1+REL1.42, and 1.4.0 contain a patch.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| MediaWiki | >=1.8.0<1.3.1+REL1.39>=1.3.1+REL1.42<1.4.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/lakejason0/mediawiki-skins-Lakeus/blob/82ad2cd341f85b814a6a0f37969e6210ebf2521d/includes/SkinLakeus.php#L27
- https://github.com/lakejason0/mediawiki-skins-Lakeus/blob/82ad2cd341f85b814a6a0f37969e6210ebf2521d/resources/themeDesigner.js
- https://github.com/lakejason0/mediawiki-skins-Lakeus/commit/fb79928f06efa47677fff27e0f4755eb32b1c8d9
- https://github.com/lakejason0/mediawiki-skins-Lakeus/security/advisories/GHSA-mq77-3q68-v64v
Frequently Asked Questions
What is the severity of CVE-2025-25287?
CVE-2025-25287 is classified as a moderate severity vulnerability due to its potential impact on user data through cross-site scripting.
How do I fix CVE-2025-25287?
To fix CVE-2025-25287, upgrade to MediaWiki Lakeus version 1.3.1+REL1.39, 1.3.1+REL1.42, or 1.4.0.
Who is affected by CVE-2025-25287?
CVE-2025-25287 affects users of MediaWiki Lakeus versions 1.8.0 through 1.3.1+REL1.39 and 1.3.1+REL1.42.
What type of attack does CVE-2025-25287 exploit?
CVE-2025-25287 exploits a cross-site scripting vulnerability that can be triggered through malicious system messages.
What are the prerequisites for exploiting CVE-2025-25287?
Exploitation of CVE-2025-25287 requires high privileges to edit system messages on the MediaWiki platform.
- collector/nvd-api
- source/NVD
- agent/severity
- agent/last-modified-date
- agent/weakness
- agent/references
- agent/author
- agent/first-publish-date
- agent/description
- agent/type
- agent/event
- agent/guess-ai
- agent/software-canonical-lookup
- agent/softwarecombine
- collector/epss-latest
- source/FIRST
- agent/source
- agent/tags
- agent/epss
- vendor/mediawiki
- canonical/mediawiki