{"id":"MGASA-2020-0381","summary":"Updated mediawiki packages fix security vulnerability","details":"Multiple security issues were discovered in MediaWiki: SpecialUserRights could\nleak whether a user existed or not, multiple code paths lacked HTML\nsanitisation allowing for cross-site scripting and TOTP validation applied\ninsufficient rate limiting against brute force attempts (CVE-2020-25812,\nCVE-2020-25813, CVE-2020-25814, CVE-2020-25815, CVE-2020-25827,\nCVE-2020-25828).\n\nPossible issues with actors not being loaded from the correct database or wiki\n(CVE-2020-25869).\n","modified":"2026-04-16T00:10:52.928851619Z","published":"2020-09-30T10:01:40Z","upstream":["CVE-2020-25812","CVE-2020-25813","CVE-2020-25814","CVE-2020-25815","CVE-2020-25827","CVE-2020-25828","CVE-2020-25869"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2020-0381.html"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=27331"},{"type":"WEB","url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-September/000260.html"},{"type":"WEB","url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-September/000262.html"},{"type":"WEB","url":"https://www.debian.org/security/2020/dsa-4767"}],"affected":[{"package":{"name":"mediawiki","ecosystem":"Mageia:7","purl":"pkg:rpm/mageia/mediawiki?arch=source&distro=mageia-7"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.31.10-1.mga7"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2020-0381.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}