~ / search / GHSA-2f58-vf6g-6p8x

GHSA-2f58-vf6g-6p8x

MediaWiki Cross-site Scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-25815

Packages

EcosystemPackageAffectedFixed in
Packagist mediawiki/core >= 1.32.0, < 1.34.3 1.34.3
Packagist mediawiki/core >= 1.35.0-rc.0, < 1.35.0 1.35.0

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in MediaWiki 1.32.x through 1.34.x before 1.34.4. LogEventList::getFiltersDesc is insecurely using message text to build options names for an HTML multi-select field. The relevant code should use escaped() instead of text().

References

External links from the advisory. They lead to third-party sites.