CVE-2020-27621

The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address

published October 22, 2020

CVSS
—
EPSS
1%
Percentile
52.9
In the wild
Unconfirmed
What it is

The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. Instead, for various actions, it would report the IP address of an internal Wikimedia Foundation server by omitting X-Forwarded-For data. This resulted in an inability to properly audit and attribute various user actions performed via the FileImporter extension.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00709 · 52.9th percentile
Published
2020-10-22T03:04Z
EPSS history
Timeline
  • 22 OCT 03:04Z
    The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address
    cvelistv5