mediawiki/core
Free software wiki application developed by the Wikimedia Foundation and others
65%
Total Score
caution
Usable with caveats: Packagist marks the package abandoned despite an active Wikimedia repository.
Health Score Breakdown
Packagist marks the entire package as abandoned, with no replacement named. This is a meaningful registry warning even though the linked Wikimedia repository remains active.
The repository name does not match mediawiki/core and its README does not mention the package name. Although this may reflect a monorepo layout, the package-to-source relationship is less transparent.
Vulnerabilities
| Title | Versions | Severity |
|---|---|---|
CVE-2023-45363 mediawiki/core is vulnerable to Loop with Unreachable Exit Condition ('Infinite Loop') in versions 0.0.0 - 1.35.12, 1.36.0 - 1.39.5 and 1.40.0 - 1.40.0. | 0.0.0 - 1.35.121.36.0 - 1.39.51.40.0 - 1.40.0 | High |
CVE-2023-29141 mediawiki/core is vulnerable to Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') in versions 1.39.0 - 1.39.3, 1.38.0 - 1.38.6 and 0.0.0 - 1.35.10. | 0.0.0 - 1.35.101.38.0 - 1.38.61.39.0 - 1.39.3 | Critical |
CVE-2020-25827 mediawiki/core is vulnerable to Improper Restriction of Excessive Authentication Attempts in versions 1.31.0 - 1.31.9 and 1.32.0 - 1.34.3. | 1.31.0 - 1.31.91.32.0 - 1.34.3 | High |
CVE-2020-25813 mediawiki/core is vulnerable to Security Vulnerability in versions 1.31.0 - 1.31.9 and 1.32.0 - 1.34.3. | 1.31.0 - 1.31.91.32.0 - 1.34.3 | Medium |
CVE-2020-25815 mediawiki/core is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 1.32.0 - 1.34.3 and 1.35.0-rc.0 - 1.35.0. | 1.32.0 - 1.34.31.35.0-rc.0 - 1.35.0 | Medium |
Package versions
Maintainers
 MediaWiki Community |
Direct Dependencies
| Dependency | Last Release | Score |
|---|---|---|
 psr/log Version 1.1.4 | — | — |
pear/mail Version 2.0.0 | — | — |
mck89/peast Version 1.17.5 | — | — |
lcobucci/jwt Version 5.6.0 | — | — |
oojs/oojs-ui Version 0.53.2 | — | — |
Weekly Downloads
Info
- Last Published
- 8 days ago
- Created
- 13 years ago
Are You Affected?
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.
I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001CompliantISO 42001Compliant
FedRAMPImplementing© All Intel data is openly available and commercially licensed.