CVE-2020-25812: MediaWiki Cross-site Scripting (XSS) vulnerability
(updated )
An issue was discovered in MediaWiki 1.34.x before 1.34.3. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw HTML.
References
- gerrit.wikimedia.org/g/mediawiki/core/+/ad4a3ba45fb955aa8c0eb3c83809b16b40a498b9/includes/specials/SpecialContributions.php
- github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2020-25812.yaml
- github.com/advisories/GHSA-rj9p-8jxj-2ch4
- github.com/wikimedia/mediawiki
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6
- lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html
- lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html
- nvd.nist.gov/vuln/detail/CVE-2020-25812
- phabricator.wikimedia.org/T255918
Code Behaviors & Features
Detect and mitigate CVE-2020-25812 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →