CVE-2020-25869
published 2020-09-27CVE-2020-25869: An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the…
PriorityP338high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
1.41%
69.6th percentile
An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the correct database or correct wiki.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| fedoraproject | fedora | — | — |
| mediawiki | mediawiki | < 1.31.10 | 1.31.10 |
| mediawiki | mediawiki | >= 1.32.0 < 1.34.4 | 1.34.4 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:P/I:N/A:N
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
mediawiki: handling of actor ID does not necessarily use the correct database or correct wiki leads to information disclosure
vendor_redhat·2020-09-27·CVSS 7.5
CVE-2020-25869 [HIGH] CWE-200 mediawiki: handling of actor ID does not necessarily use the correct database or correct wiki leads to information disclosure
mediawiki: handling of actor ID does not necessarily use the correct database or correct wiki leads to information disclosure
An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the correct database or correct wiki.
Statement: OpenShift Container Platform (OCP) delivers the mediawiki package, but the vulnerable code is not bundled, therefore OCP is not affected by this flaw.
Package: mediawiki (Red Hat OpenShift Container Platform 3.11) - Not affected
Package: mediawiki (Red Hat OpenShift Container Platform 4) - Not affected
GHSA
GHSA-7369-45qw-88c2: An information leak was discovered in MediaWiki before 1
ghsa_unreviewed·2022-05-24
CVE-2020-25869 [HIGH] CWE-755 GHSA-7369-45qw-88c2: An information leak was discovered in MediaWiki before 1
An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the correct database or correct wiki.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.htmlhttps://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.htmlhttps://phabricator.wikimedia.org/T260485https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.htmlhttps://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.htmlhttps://phabricator.wikimedia.org/T260485
2020-09-27
Published