PT-2020-6677 · Mediawiki+1 · Mediawiki+1

Umherirrender · Published 2020-12-18 · Updated 2024-03-06 · CVE-2020-35474

Positive Technologies (AI Summary)

CVSS v2.0

6.4

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.35.1

Description The issue exists due to the lack of protection for the web page structure in MediaWiki, specifically with the combination of Html::rawElement and Message::text. This can be exploited by a remote attacker to conduct a cross-site scripting (XSS) attack. The vulnerability arises because the definition of MediaWiki:recentchanges-legend-watchlistexpiry can be changed onwiki, allowing the output to be raw HTML.

Recommendations For versions prior to 1.35.1, update to version 1.35.1 or later to resolve the issue. As a temporary workaround, consider restricting changes to the MediaWiki:recentchanges-legend-watchlistexpiry definition to prevent raw HTML output.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2020-3554

ALT-PU-2020-3568

BDU:2022-03987

BIT-MEDIAWIKI-2020-35474

CVE-2020-35474

Affected Products

Alt Linux

Mediawiki

References · 21

• 🔥 https://phabricator.wikimedia.org/T268894 · Exploit
• https://ubuntu.com/security/CVE-2020-35474 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-03987 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STT5Z4A3BCXVH3WIPICWU2FP4IPIMUPC · Vendor Advisory
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December/000268.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35474 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35474 · Security Note
• https://osv.dev/vulnerability/BIT-mediawiki-2020-35474 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/STT5Z4A3BCXVH3WIPICWU2FP4IPIMUPC · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-35474 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-35474 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-35474 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-35474 · Vendor Advisory
• https://lists.wikimedia.org/pipermail/wikitech-l/2020-December/094126.html · Note
• https://xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/2.1 · Note