This page tracks the Debian fix status. The vulnerability itself is described on the main CVE page. View CVE-2020-35478 →

DEBIAN-CVE-2020-35478

MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. MediaWiki:blanknamespace potentially can be output as raw HTML with SCRIPT tags via LogF...

Original description

The description as published by the source.

MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. MediaWiki:blanknamespace potentially can be output as raw HTML with SCRIPT tags via LogFormatter::makePageLink(). This affects MediaWiki 1.33.0 and later.

Source: OSV.dev (Open Source Vulnerabilities) OSV

Affected packages

Debian:12 mediawiki

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.1-1"}]}]

Debian:13 mediawiki

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.1-1"}]}]

Debian:14 mediawiki

[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.1-1"}]}]

References

advisory security-tracker.debian.org