Vulnerability Details CVE-2020-35478
MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. MediaWiki:blanknamespace potentially can be output as raw HTML with SCRIPT tags via LogFormatter::makePageLink(). This affects MediaWiki 1.33.0 and later.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.004
EPSS Ranking 59.8%
CVSS Severity
CVSS v3 Score 6.1
CVSS v2 Score 4.3
References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STT5Z4A3BCXVH3WIPICWU2FP4IPIMUPC/
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December/000268.html
- https://phabricator.wikimedia.org/T268938
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STT5Z4A3BCXVH3WIPICWU2FP4IPIMUPC/
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December/000268.html
- https://phabricator.wikimedia.org/T268938
Products affected by CVE-2020-35478
-
cpe:2.3:a:mediawiki:mediawiki:1.33.0
-
cpe:2.3:a:mediawiki:mediawiki:1.33.1
-
cpe:2.3:a:mediawiki:mediawiki:1.33.2
-
cpe:2.3:a:mediawiki:mediawiki:1.33.3
-
cpe:2.3:a:mediawiki:mediawiki:1.33.4
-
cpe:2.3:a:mediawiki:mediawiki:1.34
-
cpe:2.3:a:mediawiki:mediawiki:1.34.0
-
cpe:2.3:a:mediawiki:mediawiki:1.34.1
-
cpe:2.3:a:mediawiki:mediawiki:1.34.2
-
cpe:2.3:a:mediawiki:mediawiki:1.34.3
-
cpe:2.3:a:mediawiki:mediawiki:1.34.4
-
cpe:2.3:a:mediawiki:mediawiki:1.35
-
cpe:2.3:a:mediawiki:mediawiki:1.35.0
-
cpe:2.3:o:fedoraproject:fedora:33