PT-2020-16727 · Mediawiki · Cosmos Skin+1

Samantha Nguyen · Published 2020-10-22 · Updated 2020-10-26 · CVE-2020-27620

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions The Cosmos Skin for MediaWiki versions through 1.35.0

Description The issue is related to stored XSS due to MediaWiki messages not being properly escaped. This is associated with wfMessage and Html::rawElement, as shown by CosmosSocialProfile::getUserGroups.

Recommendations For versions through 1.35.0, update to a version that properly escapes MediaWiki messages to prevent stored XSS. As a temporary workaround, consider restricting the use of wfMessage and Html::rawElement until a patch is available. Restrict access to CosmosSocialProfile::getUserGroups to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2020-27620

Affected Products

Cosmos Skin

Mediawiki

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2020-27620 · Security Note
• https://gerrit.wikimedia.org/r/c/mediawiki/skins/Cosmos/+/634749 · Vendor Advisory
• https://phabricator.wikimedia.org/T265440 · Vendor Advisory
• https://gerrit.wikimedia.org/r/c/mediawiki/skins/Cosmos/+/634752 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27620 · Vendor Advisory
• https://gerrit.wikimedia.org/r/c/mediawiki/skins/Cosmos/+/634751 · Vendor Advisory
• https://t.me/cibsecurity/15514 · Telegram Post