Description

In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS can happen when a user visits Special:UserRights but does not have rights to change all userrights, and the table on the left side has unchangeable groups in it. (The right column with the changeable groups is not affected and is escaped correctly.)

Remediation

References

CVE-2020-35475

Related Vulnerabilities

Django Other Vulnerability (CVE-2009-3695)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2007-5577)

WordPress Plugin WP Job Manager Cross-Site Scripting (1.23.7)

WordPress Plugin Quick Page/Post Redirect Security Bypass (5.1.9)

Drupal Core 8.9.x Remote Code Execution (8.9.0 - 8.9.8)

Severity

High

Classification

CVE-2020-35475 CWE-116 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Known Vulnerabilities