LiveActive security incident?Get immediate response
CVE Record

CVE-2020-25828: An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4.

An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be based on user input). (When jqueryMsg is loaded, it correctly accepts only whitelisted tags in message contents, and escapes all parameters. Situations with an unloaded jqueryMsg are rare in practice, but can for example occur for Special:SpecialPages on a wiki with no extensions installed.)

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2020-25828 is a MediaWiki HTML escaping flaw. In certain rare pages or configurations, text rendered through mw.message().parse() could treat user-influenced parameters as HTML instead of plain text. That can create a browser-side injection risk for users visiting affected wiki pages.

Executive priority

Treat this as a timely maintenance fix for affected MediaWiki sites, especially internet-facing wikis. The evidence suggests a narrower, configuration-dependent issue rather than confirmed widespread exploitation, but browser-side injection bugs can affect user trust and administrative sessions.

Technical view

MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4 mishandles the non-jqueryMsg path of mw.message().parse(). When jqueryMsg is not loaded, message contents and parameters are not escaped consistently. Parameters may be user-controlled, creating potential HTML injection exposure.

Likely exposure

Exposure is limited to affected MediaWiki versions and reachable code paths where jqueryMsg is not loaded. The source notes this is rare in practice, but possible on Special:SpecialPages for a wiki with no extensions installed.

Exploitation context

The source bundle does not show KEV listing, active exploitation, public exploit activity, CVSS, or CWE data. Risk depends on whether unauthenticated or low-privilege users can influence message parameters rendered through the vulnerable path.

Researcher notes

The key uncertainty is reachability. Message contents are described as generally safe, while parameters may derive from user input. Situations without jqueryMsg are rare, so validation should focus on affected versions plus actual rendering paths, not version matching alone.

Mitigation direction

  • Upgrade MediaWiki to 1.31.10, 1.34.4, or a later fixed supported release.
  • Review Wikimedia and distribution advisories for branch-specific update guidance.
  • Prioritize externally accessible wikis and wikis allowing untrusted user input.
  • Check packaged deployments, including Fedora packages, for vendor-supplied updates.

Validation and detection

  • Inventory MediaWiki versions across public and internal wiki instances.
  • Confirm vulnerable branches are not running: before 1.31.10 or 1.32.x through pre-1.34.4.
  • Review pages where mw.message().parse() may receive user-controlled parameters.
  • Verify whether jqueryMsg is loaded on relevant pages and configurations.
  • Confirm patched versions are deployed through application or package manager records.
Prepared
Confidence
medium
Sources
5

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2020-25828 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.