MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php
published December 18, 2020
CVSS
—
EPSS
1%
Percentile
71.7
In the wild
Unconfirmed
What it is
MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php. MediaWiki:blanknamespace potentially can be output as raw HTML with SCRIPT tags via LogFormatter::makePageLink(). This affects MediaWiki 1.33.0 and later.
The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01370 · 71.7th percentile
Published
2020-12-18T07:33Z
EPSS history
Timeline
18 DEC 07:33Z
MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php