CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 2CVE-2020-27621
https://notcve.org/view.php?id=CVE-2020-27621
The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. Instead, for various actions, it would report the IP address of an internal Wikimedia Foundation server by omitting X-Forwarded-For data. This resulted in an inability to properly audit and attribute various user actions performed via the FileImporter extension. La extensión FileImporter en MediaWiki versiones hasta 1.35.0 no atribuía apropiadamente varias acciones de usuario a la dirección IP de un usuario específico. En cambio, para varias acciones, informaría la dirección IP de un servidor interno de Wikimedia Foundation al omitir datos X-Fordered-For. • https://gerrit.wikimedia.org/r/q/I24a240253c7a5c66dd493a68e8c23d95a17e1b21 https://phabricator.wikimedia.org/T265810 •
CVSS: 5.3EPSS: 0%CPEs: 3EXPL: 0CVE-2020-25813
https://notcve.org/view.php?id=CVE-2020-25813
In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users. En MediaWiki versiones anteriores a 1.31.10 y desde 1.32.x hasta 1.34.x anteriores a 1.34.4, Special:UserRights expone la existencia de usuarios ocultos • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6 https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html https://meta.wikimedia.org/wiki/Special:UserRights •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 1CVE-2020-25827
https://notcve.org/view.php?id=CVE-2020-25827
An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/cluster (such as via CentralAuth), rate limiting of OATH tokens is only done on a single site level. Thus, multiple requests can be made across many wikis/sites concurrently. Se detectó un problema en la extensión OATHAuth en MediaWiki versiones anteriores a 1.31.10 y desde 1.32.x hasta 1.34.x anteriores a 1.34.4. Para los wikis que usan OATHAuth en un farm/cluster (tal y como mediante CentralAuth), la limitación de velocidad de los tokens OATH solo se realiza en un nivel de sitio único. • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6 https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html https://phabricator.wikimedia.org/T251661 • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 7.5EPSS: 0%CPEs: 3EXPL: 0CVE-2020-25869
https://notcve.org/view.php?id=CVE-2020-25869
An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the correct database or correct wiki. Se detectó un filtrado de información en MediaWiki versiones anteriores a 1.31.10 y desde 1.32.x hasta 1.34.x anteriores a 1.34.4. El manejo de la identificación del actor no necesariamente usa la base de datos correcta o la wiki correcta • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6 https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html https://phabricator.wikimedia.org/T260485 • CWE-863: Incorrect Authorization •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 0CVE-2020-25814
https://notcve.org/view.php?id=CVE-2020-25814
In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, XSS related to jQuery can occur. The attacker creates a message with [javascript:payload xss] and turns it into a jQuery object with mw.message().parse(). The expected result is that the jQuery object does not contain an <a> tag (or it does not have a href attribute, or it's empty, etc.). The actual result is that the object contains an <a href ="javascript... that executes when clicked. En MediaWiki versiones anteriores a 1.31.10 y desde 1.32.x hasta 1.34.x anteriores a 1.34.4, puede ocurrir un ataque de tipo XSS relacionado con jQuery. • https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6 https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html https://www.mediawiki.org/wiki/ResourceLoader/Core_modules#mediawiki.jqueryMsg • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •