CVE-2020-27620

The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped

published October 22, 2020

CVSS
—
EPSS
1%
Percentile
66.0
In the wild
Unconfirmed
What it is

The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped. This is related to wfMessage and Html::rawElement, as demonstrated by CosmosSocialProfile::getUserGroups.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01123 · 66.0th percentile
Published
2020-10-22T03:05Z
EPSS history
Timeline
  • 22 OCT 03:05Z
    The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped
    cvelistv5