MediaWiki Cross-site Scripting (XSS) vulnerability

TRUNG BÌNH 6.1CVE-2020-25828 · BIT-mediawiki-2020-25828 · GHSA-h8qx-mj6v-2934 · Công bố 27/09/2020 · cập nhật 17/06/2026

Tóm tắt nhanh

CVE-2020-25828 là lỗ hổng mức TRUNG BÌNH (CVSS 6.1) ảnh hưởng mediawiki/core, mediawiki (mediawiki).
Xác suất bị khai thác trong 30 ngày tới (EPSS): 1.1%, cao hơn 65.3% các lỗ hổng khác.
Cách xử lý: cập nhật lên 1.31.9, 1.34.3, 1.35.0, 1.34.4 hoặc mới hơn.

Gói / sản phẩm	Phiên bản bị ảnh hưởng	Phiên bản đã vá
mediawiki/core Packagist	`≥ 1.31.0, < 1.31.9≥ 1.32.0, < 1.34.3≥ 1.35.0-rc.0, < 1.35.0`	`1.31.91.34.31.35.0`
mediawiki mediawiki	`= 1.31.10≥ 1.32.0, < 1.34.4`	`1.34.4`

Mô tả

An issue was discovered in MediaWiki before 1.31.9 and 1.32.x through 1.34.x before 1.34.3. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be based on user input). (When jqueryMsg is loaded, it correctly accepts only whitelisted tags in message contents, and escapes all parameters. Situations with an unloaded jqueryMsg are rare in practice, but can for example occur for Special:SpecialPages on a wiki with no extensions installed.)

Mô tả của NVD

An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be based on user input). (When jqueryMsg is loaded, it correctly accepts only whitelisted tags in message contents, and escapes all parameters. Situations with an unloaded jqueryMsg are rare in practice, but can for example occur for Special:SpecialPages on a wiki with no extensions installed.)