CVE-2020-25812: Unescaped message used in HTML on Special:Contributions
An issue was discovered in MediaWiki 1.34.x before 1.34.3. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw HTML.
Other sources
An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw HTML.
Unescaped message used in HTML on Special:Contributions
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/mediawiki/coreto a version that resolves this vulnerability.Fixed in 1.35.0 - Upgrade
Upgrade
composer/mediawiki/coreto a version that resolves this vulnerability.Fixed in 1.34.3 - Upgrade
Upgrade
debian/mediawikito a version that resolves this vulnerability.Fixed in 1:1.39.17-1+deb12u2Fixed in 1:1.43.9+dfsg-1~deb13u1Fixed in 1:1.43.11+dfsg-3
Event History
Frequently Asked Questions
What configuration change is required for exploitation?
At least one message used by the namespace filter on Special:Contributions must have been changed to include raw HTML. The issue is described as a mild XSS under that condition.
Which deployments are identified as affected?
The affected MediaWiki branch is 1.34.x before 1.34.3 and before 1.34.4, as stated in the issue description. The listed software entries include composer/mediawiki/core, Debian mediawiki, MediaWiki, and Fedora.
Does exploitation require authentication or user interaction?
The supplied CVSS vector indicates no privileges are required (PR:N) but user interaction is required (UI:R). It also indicates network attack vector and low attack complexity.