MGASA-2020-0381
- Source
- https://advisories.mageia.org/MGASA-2020-0381.html
- Import Source
- https://advisories.mageia.org/MGASA-2020-0381.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/MGASA-2020-0381
- Related
- Published
- 2020-09-30T10:01:40Z
- Modified
- 2020-09-30T09:28:51Z
- Summary
- Updated mediawiki packages fix security vulnerability
- Details
-
Multiple security issues were discovered in MediaWiki: SpecialUserRights could leak whether a user existed or not, multiple code paths lacked HTML sanitisation allowing for cross-site scripting and TOTP validation applied insufficient rate limiting against brute force attempts (CVE-2020-25812, CVE-2020-25813, CVE-2020-25814, CVE-2020-25815, CVE-2020-25827, CVE-2020-25828).
Possible issues with actors not being loaded from the correct database or wiki (CVE-2020-25869).
- References
-
- https://advisories.mageia.org/MGASA-2020-0381.html
- https://bugs.mageia.org/show_bug.cgi?id=27331
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-September/000260.html
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-September/000262.html
- https://www.debian.org/security/2020/dsa-4767
- Credits
-
-
- Mageia - COORDINATOR
-
Affected packages
Mageia:7 / mediawiki
Package
- Name
- mediawiki
- Purl
- pkg:rpm/mageia/mediawiki?distro=mageia-7