PT-2020-16250 · Wikimedia+1 · Mediawiki+1

Martin Urbanec + 1 · Published 2020-09-27 · Updated 2024-03-06 · CVE-2020-25869

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.31.10 MediaWiki versions 1.32.x through 1.34.3

Description An information leak was discovered due to incorrect handling of actor ID, which may not use the correct database or wiki.

Recommendations For MediaWiki versions prior to 1.31.10, update to version 1.31.10 or later. For MediaWiki versions 1.32.x through 1.34.3, update to version 1.34.4 or later.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2020-3022

ALT-PU-2020-3055

BIT-MEDIAWIKI-2020-25869

CVE-2020-25869

MGASA-2020-0381

Affected Products

Alt Linux

Mediawiki

References · 13

• https://phabricator.wikimedia.org/T260485 · Vendor Advisory
• https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-25869 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2020-0381.html · Security Note
• https://osv.dev/vulnerability/BIT-mediawiki-2020-25869 · Vendor Advisory
• https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-25869 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2020-0381 · Vendor Advisory
• https://debian.org/security/2020/dsa-4767 · Vendor Advisory
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-September/000260.html · Note
• https://bugs.mageia.org/show_bug.cgi?id=27331 · Note
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-September/000262.html · Note