CVE-2020-25827: High severity mediawiki vulnerability

Published Sep 27, 2020
·
Updated

An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/cluster (such as via CentralAuth), rate limiting of OATH tokens is only done on a single site level. Thus, multiple requests can be made across many wikis/sites concurrently.

Other sources

An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.9 and 1.32.x through 1.34.x before 1.34.3. For Wikis using OATHAuth on a farm/cluster (such as via CentralAuth), rate limiting of OATH tokens is only done on a single site level. Thus, multiple requests can be made across many wikis/sites concurrently.

GitHub

Affected Software

7 affected componentsFixes available
composer/mediawiki/core>=1.31.0, <1.31.9, >=1.34.0, <1.34.3
debian/mediawiki
1:1.31.16-1+deb10u21:1.31.16-1+deb10u61:1.35.11-1~deb11u11:1.35.13-1~deb11u11:1.39.4-1~deb12u11:1.39.5-1~deb12u11:1.39.5-1
composer/mediawiki/core>=1.32.0<1.34.3
1.34.3
composer/mediawiki/core>=1.31.0<1.31.9
1.31.9
MediaWiki<1.31.10
MediaWiki>=1.32.0<1.34.4
fedoraproject fedora=33

Event History

Sep 27, 2020
CVE Published
via MITRE·08:43 PM
Data Sourced
via MITRE·08:43 PM
Description
May 24, 2022
Advisory Published
via GitHub·05:29 PM

Frequently Asked Questions

1

What is the severity of CVE-2020-25827?

CVE-2020-25827 has been assigned a moderate severity rating due to its potential for OATH token abuse.

2

How do I fix CVE-2020-25827?

To fix CVE-2020-25827, upgrade to MediaWiki version 1.31.10, 1.34.4, or any later version.

3

Which versions of MediaWiki are affected by CVE-2020-25827?

CVE-2020-25827 affects MediaWiki versions from 1.31.0 to 1.31.9 and 1.34.0 to 1.34.3.

4

Does CVE-2020-25827 affect all installations of MediaWiki?

CVE-2020-25827 specifically affects MediaWiki instances using the OATHAuth extension in a farm or cluster setup.

5

What are the risks associated with CVE-2020-25827?

The risk associated with CVE-2020-25827 includes susceptibility to rate limiting bypass which could lead to unauthorized access.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203