CVE-2025-23074

Special:EditProfile exposes the contents of profile fields marked "hidden"/friends or "friends of friends" when the privileged user isn't a friend of the user whose profile they edit(ed)

State: Published
Severity: 2.4 Low
Published: Jan 14, 2025
Updated: Jan 31, 2025
Reserved: Jan 10, 2025

Read the record on cve.org

Description

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Wikimedia Foundation Mediawiki - SocialProfile Extension allows Functionality Misuse.This issue affects Mediawiki - SocialProfile Extension: from 1.39.X before 1.39.11, from 1.41.X before 1.41.3, from 1.42.X before 1.42.2.

Scores

CVSS	Score	Vector	Source
3.1	2.4 Low	CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N	CISA-ADP

Weaknesses

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Affected Products

Product	Versions
Mediawiki - SocialProfile ExtensionWikimedia Foundation	1.39.x to before 1.39.11Affected 1.41.x to before 1.41.3Affected 1.42.x to before 1.42.2Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.