CVE-2020-25814

Katalog CVE

CVSS 6.1 · Medium EPSS 1,4%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada mediawiki, fedoraproject fedora. Skor CVSS 3.1 6.1 (Medium) menurut NVD.

Deskripsi (NVD)

In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. The attacker creates a message with [javascript:payload xss] and turns it into a jQuery object with mw.message().parse(). The expected result is that the jQuery object does not contain an <a> tag (or it does not have a href attribute, or it's empty, etc.). The actual result is that the object contains an <a href ="javascript... that executes when clicked.

Rincian

Terbit di NVD

27 September 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

6.1 (Medium), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

EPSS (30 hari)

1,4% peluang dieksploitasi; lebih tinggi dari 70,7% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html mailing list · release notes · advisory vendor
• https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html mailing list · release notes · advisory vendor
• https://www.mediawiki.org/wiki/ResourceLoader/Core_modules#mediawiki.jqueryMsg advisory vendor
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I...