~ / search / GHSA-4vr7-m8p8-434h

GHSA-4vr7-m8p8-434h

MediaWiki Cross-site Scripting (XSS) vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2020-25814

Packages

EcosystemPackageAffectedFixed in
Packagist mediawiki/core >= 1.31.0, < 1.31.9 1.31.9
Packagist mediawiki/core >= 1.32.0, < 1.34.3 1.34.3
Packagist mediawiki/core >= 1.35.0-rc.0, < 1.35.0 1.35.0

Details

As written in the advisory (Markdown source, shown as plain text).

In MediaWiki before 1.31.9 and 1.32.x through 1.34.x before 1.34.3, XSS related to jQuery can occur. The attacker creates a message with [javascript:payload xss] and turns it into a jQuery object with mw.message().parse(). The expected result is that the jQuery object does not contain an <a> tag (or it does not have a href attribute, or it's empty, etc.). The actual result is that the object contains an <a href ="javascript... that executes when clicked.

References

External links from the advisory. They lead to third-party sites.