Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-25812

CVE-2020-25812:
MediaWiki Cross-site Scripting (XSS) vulnerability

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-25812
GHSA ID
GHSA-rj9p-8jxj-2ch4
EPSS Score
0.57351%
CWE
CWE-79
Published
5/24/2022
Updated
5/17/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
mediawiki/corecomposer>= 1.34.0, < 1.34.31.34.3
mediawiki/corecomposer>= 1.35.0-rc.0, < 1.35.01.35.0

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from the 'nsFilters' field in SpecialContributions.php, where message text was used directly as HTML option keys without escaping. The Gerrit diff shows the fix replaced ->text() with ->escaped() and switched to 'options-messages', confirming the original code used unsafe output. The function responsible for building this form element (getForm) is the root cause.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n issu* w*s *is*ov*r** in M**i*Wiki *.**.x ***or* *.**.*. On Sp**i*l:*ontri*utions, t** NS *ilt*r us*s un*s**p** m*ss***s *s k*ys in t** option k*y *or *n *TML*orm sp**i*i*r. T*is is vuln*r**l* to * mil* XSS i* on* o* t*os* m*ss***s is ***n*** to in

Reasoning

T** vuln*r**ility st*ms *rom t** 'ns*ilt*rs' *i*l* in `Sp**i*l*ontri*utions.p*p`, w**r* m*ss*** t*xt w*s us** *ir**tly *s *TML option k*ys wit*out *s**pin*. T** **rrit *i** s*ows t** *ix r*pl**** `->t*xt()` wit* `->*s**p**()` *n* swit**** to 'options