Servers and applications
CVE-2020-25815
An issue was discovered in MediaWiki 1.32.x through 1.34.x before 1.34.4. LogEventList::getFiltersDesc is insecurely using message text to build options names for an HTML multi-select field. The relevant code should use escaped() instead of text().
- Severity
- Medium 6.1
- Published
- 27 Sept 2020
- Last changed
- 17 Jun 2026
- Added to UpHeron
- 21 Oct 2026
- Fixed in
- 1.34.4
- Sources
- NVD
Affected software
| Software | Affected versions |
|---|---|
MediaWikiServers and applications · cpe:a:mediawiki:mediawiki |
|