Skip to content
OpenAdvisories
Unscored DLA-2504-1 4 CVEs

mediawiki - security update

Published Dec 22, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 mediawiki 1:1.27.7-1~deb9u7

Vulnerabilities 4

  • Medium —
    CVE-2020-15005

    img_auth.php may leak private extension images into the public cache

    In MediaWiki before 1.31.8, 1.32.x and 1.33.x before 1.33.4, and 1.34.x before 1.34.2, private wikis behind a caching server using the img_auth.php image authorization security feature may have had their files cached publicly, so any unauthorized user could v…

    mediawiki mediawiki mediawiki/core Debian Ubuntu Packagist
  • Unscored —
    CVE-2020-35477

    MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpa…

    mediawiki mediawiki Debian Ubuntu
  • Unscored —
    CVE-2020-35479

    MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. Language::translateBlockExpiry itself does not escape in …

    mediawiki mediawiki Debian Ubuntu
  • Unscored —
    CVE-2020-35480

    An issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don't exist) and hidden users (account…

    mediawiki mediawiki Debian Ubuntu