CVE-2020-25815: XSS

Q: What is the severity of CVE-2020-25815?

CVE-2020-25815 has a medium severity rating due to potential XSS vulnerabilities in MediaWiki.

Q: How do I fix CVE-2020-25815?

To fix CVE-2020-25815, you should upgrade to MediaWiki versions 1.34.4, 1.35.0, or later.

Q: What versions of MediaWiki are affected by CVE-2020-25815?

CVE-2020-25815 affects MediaWiki versions 1.32.x through 1.34.x prior to 1.34.4.

Q: What kind of vulnerability is CVE-2020-25815?

CVE-2020-25815 is classified as a Cross-Site Scripting (XSS) vulnerability due to improper escaping of message text.

Q: Is there a patch available for CVE-2020-25815?

Yes, users can apply the patch by updating to the specified fixed versions of MediaWiki.

Published Sep 24, 2020

Updated

An issue was discovered in MediaWiki 1.32.x through 1.34.x before 1.34.4. LogEventList::getFiltersDesc is insecurely using message text to build options names for an HTML multi-select field. The relevant code should use escaped() instead of text().

Other sources

Unescaped message used in HTML within LogEventsList

Affected Software

6 affected componentsFixes available

composer/mediawiki/core>=1.34.0, <1.34.3, >=1.34.99, <1.35.0

debian/mediawiki

1:1.31.16-1+deb10u21:1.31.16-1+deb10u61:1.35.11-1~deb11u11:1.35.13-1~deb11u11:1.39.4-1~deb12u11:1.39.5-1~deb12u11:1.39.5-1

composer/mediawiki/core>=1.35.0-rc.0<1.35.0

1.35.0

composer/mediawiki/core>=1.32.0<1.34.3

1.34.3

MediaWiki>=1.32.0<1.34.4

fedoraproject fedora=33

Remediation

Patch Available

https://gerrit.wikimedia.org/g/mediawiki/core/+/ec76e14be658187544f07c1a249a047e1a75eaf8/includes/logging/LogEventsList.php#214

Event History

Sep 24, 2020

Advisory Published

05:14 PM

Sep 27, 2020

CVE Published

via MITRE·08:27 PM

Data Sourced

via MITRE·08:27 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-25815?