[SECURITY] [DLA 2379-1] mediawiki security update

🗓️ 26 Sep 2020 01:26:02Reported by DebianType

mediawiki security update for Debian 9 stretch, version 1:1.27.7-1~deb9u4 includes fixes for multiple security issues such as user existence leak, cross-site scripting, and insufficient rate limitin

Reporter	Title	Published	Views	Family All 113
BDU FSTEC	The vulnerability of the Special:UserRights component of the MediaWiki software, which enables the implementation of a hypertext environment, allows a perpetrator to disclose protected information.	30 Nov 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the mw.message.parse() function in the software framework for implementing the MediaWiki hypertext environment allows a attacker to perform XSS attacks.	30 Nov 202200:00	–	bdu_fstec
BDU FSTEC	The vulnerability of the OATHAuth extension of the software platform for implementing the MediaWiki hypertext environment allows a hacker to circumvent existing security restrictions through brute-force attacks.	30 Nov 202200:00	–	bdu_fstec
ALT Linux	Security fix for the ALT Linux 9 package mediawiki version 1.35.0-alt1	14 Oct 202000:00	–	altlinux
Circl	CVE-2020-25814	28 Sep 202000:48	–	circl
Circl	CVE-2020-25827	28 Sep 202000:48	–	circl
CNVD	MediaWiki Code Problem Vulnerability	29 Sep 202000:00	–	cnvd
CNVD	MediaWiki Special:UserRights Code Issue Vulnerability	10 Oct 202000:00	–	cnvd
CNVD	Unspecified Vulnerability in MediaWiki (CNVD-2021-38686)	4 Oct 202000:00	–	cnvd
CVE	CVE-2020-25813	27 Sep 202020:44	–	cve

OS	OS Version	Architecture	Package	Package Version	Filename
Debian	9	any	mediawiki	1:1.27.7-1~deb9u4	mediawiki_1:1.27.7-1~deb9u4_any.deb
Debian	9	any	mediawiki-classes	1:1.27.7-1~deb9u4	mediawiki-classes_1:1.27.7-1~deb9u4_any.deb

26 Sep 2020 01:26Current

6.6Medium risk

Vulners AI Score6.6

CVSS 25

CVSS 3.17.5

EPSS0.01752