Wikimedia Foundation MediaWiki Sensitive Information Exposure Vulnerability

A vulnerability allowing the exposure of sensitive information from private wikis has been identified in Wikimedia Foundation MediaWiki versions prior to 1.39.12, 1.42.76, 1.43.1, and 1.44.0. This issue arises from the PasswordReset Wikitext injection in error messages, which can be exploited to leak private content.

Impact

Exploitation of this vulnerability leads to a complete content leak of private wikis.

Reproduction

To reproduce this vulnerability, initiate a password reset on a private wiki. Inject Wikitext, such as a template transclusion, into the username field. The error message generated will process the Wikitext, including the injected template, which can be used to exfiltrate information from the private wiki.

Remediation

Users can update to MediaWiki versions 1.39.13, 1.42.77, 1.43.2, or 1.45.0-wmf.8, where this vulnerability has been patched.