CVE-2025-61643: 
NixOS vulnerability analysis and mitigation

CVE-2025-61643 is an information disclosure vulnerability in Wikimedia Foundation MediaWiki affecting the RecentChangeRCFeedNotifier component (includes/recentchanges/RecentChangeRCFeedNotifier.php). The flaw involves improper removal of sensitive information before storage or transfer (CWE-212), specifically related to EventStreams publishing suppressed recent change entries that should be hidden. Affected versions include MediaWiki before 1.39.14, 1.43.0–1.43.3 (before 1.43.4), and 1.44.0 (before 1.44.1). It carries a CVSS v3.1 base score of 6.1 (Medium) and a CVSS v4.0 base score of 2.7 (Low) (Red Hat Advisory, Red Hat Bugzilla).

The root cause is classified as CWE-212 (Improper Removal of Sensitive Information Before Storage or Transfer). The vulnerability resides in RecentChangeRCFeedNotifier.php, where the MediaWiki EventStreams feed publishes recent change entries that have been suppressed (e.g., oversighted or deleted edits) — meaning sensitive editorial actions that administrators intended to hide are inadvertently exposed through the RC feed notifier. The attack vector is network-based, requires no privileges, and has low attack complexity, though user interaction is required per the CVSS v3.1 scoring. No public proof-of-concept exploit code has been identified (Red Hat Advisory, Red Hat Bugzilla).

Successful exploitation results in low-level confidentiality impact: suppressed or oversighted recent change entries — which may include sensitive edit metadata, deleted content references, or hidden user actions — are exposed to unauthorized parties via the EventStreams feed. Integrity is also marginally affected (CVSS v3.1 integrity impact: Low) as the scope of the vulnerability extends beyond the vulnerable component. Availability is not impacted. The practical risk is limited to information leakage of editorial suppression actions on MediaWiki instances, which could expose sensitive wiki governance activities (Red Hat Advisory).

There is no evidence of active in-the-wild exploitation or a publicly available proof-of-concept exploit for CVE-2025-61643. The EPSS score is approximately 0.052% (0.000520), indicating a very low probability of exploitation in the near term. The vulnerability has not been added to the CISA Known Exploited Vulnerabilities (KEV) catalog. No threat actor attribution has been reported (Red Hat Advisory).

Administrators should upgrade MediaWiki to one of the patched versions: 1.39.14, 1.43.4, or 1.44.1. Given the low CVSS v4.0 score and absence of active exploitation, patching can be scheduled within regular maintenance cycles but should not be indefinitely deferred due to the confidentiality exposure risk. No specific configuration-based workaround has been publicly documented; upgrading to a fixed version is the recommended remediation (Red Hat Bugzilla, Red Hat Advisory).

A blog post by a MediaWiki developer (bawolff.net) discussed the XSS protector's effectiveness in the context of MediaWiki security, tangentially referencing related issues. Debian issued a security advisory (DSA-6085-1) and an LTS advisory (DLA-4355-1) addressing this and related MediaWiki vulnerabilities. Mageia also published a security advisory (MGASA-2025-0260) covering the affected package. Community reaction has been muted given the low severity rating and absence of active exploitation (Debian LTS Announce, Debian Security Announce).