mediawiki - security update

Fixed packages 1

Vulnerabilities 4

• High 7.5
  CVE-2020-25827

  OATHAuth extension in MediaWiki is not implementing rate limit

  An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/cluster (such as via CentralAuth), rate limiting of OATH tokens is only done on a single site level. Thus…

  mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist
  Sep 27, 2020
• Medium 6.1
  CVE-2020-25814

  MediaWiki Cross-site Scripting (XSS) vulnerability

  In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. The attacker creates a message with [javascript:payload xss] and turns it into a jQuery object with mw.message().parse(). The expected result is that the jQu…

  mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist
  Sep 27, 2020
• Medium 6.1
  CVE-2020-25828

  MediaWiki Cross-site Scripting (XSS) vulnerability

  An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be …

  mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist
  Sep 27, 2020
• Medium 5.3
  CVE-2020-25813

  MediaWiki Special:UserRights exposes the existence of hidden users

  In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users.

  mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist
  Sep 27, 2020