Vulnerability Description
An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be based on user input). (When jqueryMsg is loaded, it correctly accepts only whitelisted tags in message contents, and escapes all parameters. Situations with an unloaded jqueryMsg are rare in practice, but can for example occur for Special:SpecialPages on a wiki with no extensions installed.)
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mediawiki | Mediawiki | >= 1.32.0, < 1.34.4 |
| Fedoraproject | Fedora | 33 |
Related Weaknesses (CWE)
References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.wikimedia.org/pipermail/mediawiki-announceVendor Advisory
- https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.htmlMailing ListVendor Advisory
- https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.htmlMailing ListVendor Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro
- https://lists.wikimedia.org/pipermail/mediawiki-announceVendor Advisory
- https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.htmlMailing ListVendor Advisory
- https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.htmlMailing ListVendor Advisory
FAQ
What is CVE-2020-25828?
CVE-2020-25828 is a vulnerability with a CVSS score of 6.1 (MEDIUM). An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (...
How severe is CVE-2020-25828?
CVE-2020-25828 has been rated MEDIUM with a CVSS base score of 6.1/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2020-25828?
Check the references section above for vendor advisories and patch information. Affected products include: Mediawiki Mediawiki, Fedoraproject Fedora.