First published: Fri Dec 18 2020(Updated: )
MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. Language::translateBlockExpiry itself does not escape in all code paths. For example, the return of Language::userTimeAndDate is is always unsafe for HTML in a month value. This affects MediaWiki 1.12.0 and later.
Credit: cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
debian/mediawiki | 1:1.31.16-1+deb10u2 1:1.31.16-1+deb10u6 1:1.35.11-1~deb11u1 1:1.35.13-1~deb11u1 1:1.39.4-1~deb12u1 1:1.39.5-1~deb12u1 1:1.39.5-1 | |
Wikimedia MediaWiki | >=1.12.0<1.35.1 | |
Debian | =9.0 | |
Debian | =10.0 | |
Fedora | =33 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
CVE-2020-35479 is considered a medium severity vulnerability due to its potential for cross-site scripting (XSS).
To mitigate CVE-2020-35479, upgrade MediaWiki to version 1.35.1 or later.
CVE-2020-35479 affects MediaWiki versions from 1.12.0 up to, but not including, 1.35.1.
CVE-2020-35479 is a cross-site scripting (XSS) vulnerability primarily affecting MediaWiki installations.
No, CVE-2020-35479 specifically impacts MediaWiki versions from 1.12.0 onward, excluding version 1.35.1 and above.