Description

In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS can happen when a user visits Special:UserRights but does not have rights to change all userrights, and the table on the left side has unchangeable groups in it. (The right column with the changeable groups is not affected and is escaped correctly.)

Remediation

References

CVE-2020-35475

Related Vulnerabilities

Varnish Cache Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-0345)

PHP Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability (CVE-2016-7418)

Drupal Core 6.x Multiple Vulnerabilities (6.0 - 6.13)

phpMyFAQ Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2006-6912)

Joomla Other Vulnerability (CVE-2023-23752)

Severity

High

Classification

CVE-2020-35475 CWE-116 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities