CVE-2020-25828: Non-jqueryMsg version of mw.message(…).parse() doesn't escape HTML

Q: What is the severity of CVE-2020-25828?

CVE-2020-25828 has been classified as a medium severity vulnerability due to its potential for XSS attacks through unescaped HTML.

Q: What versions are affected by CVE-2020-25828?

CVE-2020-25828 affects MediaWiki versions before 1.31.10 and versions between 1.32.x and 1.34.x before 1.34.4.

Q: How do I fix CVE-2020-25828?

To fix CVE-2020-25828, update MediaWiki to version 1.31.10, 1.34.4, or a later version.

Q: What type of vulnerability is CVE-2020-25828?

CVE-2020-25828 is a cross-site scripting (XSS) vulnerability caused by the mw.message().parse() function not escaping HTML.

Q: Is there a workaround for CVE-2020-25828?

There is no known workaround for CVE-2020-25828; updating to a patched version is recommended to mitigate the vulnerability.

Published Sep 24, 2020

Updated

An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be based on user input). (When jqueryMsg is loaded, it correctly accepts only whitelisted tags in message contents, and escapes all parameters. Situations with an unloaded jqueryMsg are rare in practice, but can for example occur for Special:SpecialPages on a wiki with no extensions installed.)

Other sources

An issue was discovered in MediaWiki before 1.31.9 and 1.32.x through 1.34.x before 1.34.3. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be based on user input). (When jqueryMsg is loaded, it correctly accepts only whitelisted tags in message contents, and escapes all parameters. Situations with an unloaded jqueryMsg are rare in practice, but can for example occur for Special:SpecialPages on a wiki with no extensions installed.)

— GitHub

Non-jqueryMsg version of mw.message(…).parse() doesn't escape HTML

Affected Software

11 affected componentsFixes available

composer/mediawiki/core>=1.31.0, <1.31.9, >=1.34.0, <1.34.3, >=1.34.99, <1.35.0

composer/mediawiki/core>=1.35.0-rc.0<1.35.0

1.35.0

composer/mediawiki/core>=1.32.0<1.34.3

1.34.3

composer/mediawiki/core>=1.31.0<1.31.9

1.31.9

MediaWiki MediaWiki>=1.32.0<1.34.4

MediaWiki MediaWiki=1.31.10

Fedoraproject Fedora=33

composer/mediawiki/core>=1.31.0, <1.31.9

1.31.9

composer/mediawiki/core>=1.34.0, <1.34.3

1.34.3

composer/mediawiki/core>=1.34.99, <1.35.0

1.35.0

debian/mediawiki

1:1.39.17-1+deb12u21:1.43.9+dfsg-1~deb13u11:1.43.11+dfsg-3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/mediawiki/core to a version that resolves this vulnerability.
Fixed in 1.35.0
Upgrade
Upgrade composer/mediawiki/core to a version that resolves this vulnerability.
Fixed in 1.34.3
Upgrade
Upgrade composer/mediawiki/core to a version that resolves this vulnerability.
Fixed in 1.31.9
Upgrade
Upgrade debian/mediawiki to a version that resolves this vulnerability.
Fixed in 1:1.39.17-1+deb12u2Fixed in 1:1.43.9+dfsg-1~deb13u1Fixed in 1:1.43.11+dfsg-3
Upgrade
Upgrade MediaWiki to a version that resolves this vulnerability.
Fixed in 1.31.10
Upgrade
Upgrade MediaWiki to a version that resolves this vulnerability.
Fixed in 1.34.4

Event History

Sep 24, 2020

Advisory Published

via Packagist·01:26 AM

Data Sourced

via Packagist·01:26 AM

DescriptionSeverityAffected Software

Advisory Published

05:14 PM

Sep 27, 2020

CVE Published

via MITRE·08:31 PM

Data Sourced

via MITRE·08:31 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

DSA-4767

Peer vulnerabilities

Found alongside the following vulnerabilities.

DLA-2379-1

Frequently Asked Questions

What is the severity of CVE-2020-25828?