CVE-2020-35475

In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML

published December 18, 2020

CVSS
—
EPSS
2%
Percentile
75.5
In the wild
Unconfirmed
What it is

In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS can happen when a user visits Special:UserRights but does not have rights to change all userrights, and the table on the left side has unchangeable groups in it. (The right column with the changeable groups is not affected and is escaped correctly.)

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01592 · 75.5th percentile
Published
2020-12-18T07:32Z
EPSS history
Timeline
  • 18 DEC 07:32Z
    In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML
    cvelistv5