Vulnerability Name:

CVE-2020-25828 (CCN-188928)

Assigned:2020-09-24
Published:2020-09-24
Updated:2022-01-01
Summary:An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be based on user input). (When jqueryMsg is loaded, it correctly accepts only whitelisted tags in message contents, and escapes all parameters. Situations with an unloaded jqueryMsg are rare in practice, but can for example occur for Special:SpecialPages on a wiki with no extensions installed.)
CVSS v3 Severity:6.1 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
6.1 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N)
5.8 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N/E:H/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
5.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-79
Vulnerability Consequences:Cross-Site Scripting
References:Source: MITRE
Type: CNA
CVE-2020-25828

Source: XF
Type: UNKNOWN
mediawiki-cve202025828-xss(188928)

Source: FEDORA
Type: Mailing List, Third Party Advisory
FEDORA-2020-a4802c53d9

Source: MISC
Type: Vendor Advisory
https://lists.wikimedia.org/pipermail/mediawiki-announce

Source: CCN
Type: MediaWiki Mailing List, Thu Sep 24 15:05:38 UTC 2020
[MediaWiki-l] Security and maintenance release: 1.31.9 / 1.34.3

Source: CONFIRM
Type: Mailing List, Vendor Advisory
https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html

Source: MISC
Type: Mailing List, Vendor Advisory
https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html

Source: CCN
Type: Phabricator Web site
Non-jqueryMsg version of mw.message(…).parse() doesn't escape HTML (CVE-2020-25828)

Source: CCN
Type: MediaWiki Web site
MediaWiki

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2020-25828

Vulnerable Configuration:Configuration 1:
  • cpe:/a:mediawiki:mediawiki:1.31.10:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:*:*:*:*:*:*:*:* (Version >= 1.32.0 and < 1.34.4)

    • Configuration 2:
  • cpe:/o:fedoraproject:fedora:33:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:mediawiki:mediawiki:1.32.1:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.33.0:-:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.31.7:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.33.3:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.34.1:*:*:*:*:*:*:*
  • OR cpe:/a:mediawiki:mediawiki:1.34.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    mediawiki mediawiki 1.31.10
    mediawiki mediawiki *
    fedoraproject fedora 33
    mediawiki mediawiki 1.32.1
    mediawiki mediawiki 1.33.0 -
    mediawiki mediawiki 1.31.7
    mediawiki mediawiki 1.33.3
    mediawiki mediawiki 1.34.1
    mediawiki mediawiki 1.34.3