p PatchFirst

CVE-2020-25827

CVE-2020-25827

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/cluster (such as via CentralAuth), rate limiting of OATH tokens is only done on a single site level. Thus, multiple requests can be made across many wikis/sites concurrently.

CVSS 7.5 · High · EPSS 1.7% · Fix available

Published
Updated

Stack: system · php

Affected products and versions

  • n/a

    Versions
    • n/a: Affected

    No fix published

  • mediawiki Debian:12

    Affected ranges
    • ECOSYSTEM: < 1:1.35.0-1

    Update to 1:1.35.0-1

  • mediawiki Debian:13

    Affected ranges
    • ECOSYSTEM: < 1:1.35.0-1

    Update to 1:1.35.0-1

  • mediawiki Debian:14

    Affected ranges
    • ECOSYSTEM: < 1:1.35.0-1

    Update to 1:1.35.0-1

  • mediawiki/core Packagist

    Versions
    • 1.31.0
    • 1.31.1
    • 1.31.2
    • 1.31.3
    • 1.31.4
    • 1.31.5
    • 1.31.6
    • 1.31.7
    • 1.31.8
    Affected ranges
    • ECOSYSTEM: ≥ 1.31.0, < 1.31.9

    Update to 1.31.9

  • mediawiki/core Packagist

    Versions
    • 1.32.0
    • 1.32.1
    • 1.32.2
    • 1.32.3
    • 1.32.4
    • 1.32.5
    • 1.32.6
    • 1.33.0
    • 1.33.0-rc.0
    • 1.33.1
    • 1.33.2
    • 1.33.3
    • 1.33.4
    • 1.34.0
    • 1.34.0-rc.0
    • 1.34.0-rc.1
    • 1.34.1
    • 1.34.2
    Affected ranges
    • ECOSYSTEM: ≥ 1.32.0, < 1.34.3

    Update to 1.34.3

  • mediawiki Ubuntu:18.04:LTS

    Versions
    • 1:1.27.3-1
    • 1:1.27.4-1
    • 1:1.27.4-2
    • 1:1.27.4-3
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • mediawiki Ubuntu:Pro:20.04:LTS

    Versions
    • 1:1.31.2-1ubuntu1
    • 1:1.31.5-1
    • 1:1.31.5-1ubuntu1
    • 1:1.31.5-2
    • 1:1.31.5-3
    • 1:1.31.5-3ubuntu1
    • 1:1.31.6-1
    • 1:1.31.7-1
    • 1:1.31.7-1ubuntu0.1~esm1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →