CVE-2020-27957

The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data

published October 28, 2020

CVSS
—
EPSS
1%
Percentile
52.3
In the wild
Unconfirmed
What it is

The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data. When certain varieties of games were created within MediaWiki, their names or titles could be manipulated to generate stored XSS within the RandomGameUnit extension.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00691 · 52.3th percentile
Published
2020-10-28T02:29Z
EPSS history
Timeline
  • 28 OCT 02:29Z
    The RandomGameUnit extension for MediaWiki through 1.35 was not properly escaping various title-related data
    cvelistv5