This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page.
View CVE-2020-25812 →
DEBIAN-CVE-2020-25812
An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key f...
Original description
The description as published by the source.
An issue was discovered in MediaWiki 1.34.x before 1.34.4. On Special:Contributions, the NS filter uses unescaped messages as keys in the option key for an HTMLForm specifier. This is vulnerable to a mild XSS if one of those messages is changed to include raw HTML.
Source: OSV.dev (Open Source Vulnerabilities) OSV
Affected packages
Debian:12
mediawiki
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.0-1"}]}]
Debian:13
mediawiki
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.0-1"}]}]
Debian:14
mediawiki
[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.0-1"}]}]
References
- advisory security-tracker.debian.org