CVE-2020-35474

6.1

MEDIUMCVSS v3

Published

December 18, 2020

CVSS v2

4.3 MEDIUM

Affected

9 projects

Assigned by

MITRE

Severity scale

010

Description

In MediaWiki before 1.35.1, the combination of Html::rawElement and Message::text leads to XSS because the definition of MediaWiki:recentchanges-legend-watchlistexpiry can be changed onwiki so that the output is raw HTML.

wikimedia/mediawiki

GitHub🌻 The collaborative editing software that runs Wikipedia. Mirror from https://gerrit.wikimedia.org/g/mediawiki/core. See https://mediawiki.org/wiki/Developer_access for contributing.

< 1.35.1NVD