CVE-2020-35479: XSS

Q: What is the severity of CVE-2020-35479?

CVE-2020-35479 is considered a medium severity vulnerability due to its potential for cross-site scripting (XSS).

Q: How do I fix CVE-2020-35479?

To mitigate CVE-2020-35479, upgrade MediaWiki to version 1.35.1 or later.

Q: Which versions of MediaWiki are affected by CVE-2020-35479?

CVE-2020-35479 affects MediaWiki versions from 1.12.0 up to, but not including, 1.35.1.

Q: What type of vulnerability is CVE-2020-35479?

CVE-2020-35479 is a cross-site scripting (XSS) vulnerability primarily affecting MediaWiki installations.

Q: Can CVE-2020-35479 impact all versions of MediaWiki?

No, CVE-2020-35479 specifically impacts MediaWiki versions from 1.12.0 onward, excluding version 1.35.1 and above.

Published Dec 18, 2020

Updated

MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. Language::translateBlockExpiry itself does not escape in all code paths. For example, the return of Language::userTimeAndDate is is always unsafe for HTML in a month value. This affects MediaWiki 1.12.0 and later.

Affected Software

5 affected componentsFixes available

debian/mediawiki

1:1.31.16-1+deb10u21:1.31.16-1+deb10u61:1.35.11-1~deb11u11:1.35.13-1~deb11u11:1.39.4-1~deb12u11:1.39.5-1~deb12u11:1.39.5-1

MediaWiki MediaWiki>=1.12.0<1.35.1

Debian Debian Linux=9.0

Debian Debian Linux=10.0

Fedoraproject Fedora=33

Event History

Dec 18, 2020

CVE Published

via MITRE·07:42 AM

Data Sourced

via MITRE·07:42 AM

Description

Frequently Asked Questions

What is the severity of CVE-2020-35479?

CVE-2020-35479 is considered a medium severity vulnerability due to its potential for cross-site scripting (XSS).

How do I fix CVE-2020-35479?

To mitigate CVE-2020-35479, upgrade MediaWiki to version 1.35.1 or later.

Which versions of MediaWiki are affected by CVE-2020-35479?