CVE-2020-25869
An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1...
An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the correct database or correct wiki.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the correct database or correct wiki.
- Record
CVE-2020-25869- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-863
- Updated
- 2026-11-02
CVE List No score
An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the correct database or correct wiki.
- Record
CVE-2020-25869- Updated
- 2026-11-02
EUVDEUVD-2020-18501 No score
An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the correct database or correct wiki.
- Record
EUVD-2020-18501- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7369-45qw-88c2 No score
An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1...
An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the correct database or correct wiki.
- Record
GHSA-7369-45qw-88c2- Weakness
- CWE-755, CWE-863
- Updated
- 2026-11-02
OSV
An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the correct database or correct wiki.
- Record
CVE-2020-25869- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVBIT-mediawiki-2020-25869 No score
An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the correct database or correct wiki.
- Record
BIT-mediawiki-2020-25869- Updated
- 2026-11-02
OSVMGASA-2020-0381 No score
Updated mediawiki packages fix security vulnerability
Multiple security issues were discovered in MediaWiki: SpecialUserRights could leak whether a user existed or not, multiple code paths lacked HTML sanitisation allowing for cross-site scripting and TOTP validation applied insufficient rate limiting against brute force attempts (CVE-2020-25812, CVE-2020-25813, CVE-2020-25814, CVE-2020-25815, CVE-2020-25827, CVE-2020-25828).
Possible issues with actors not being loaded from the correct database or wiki (CVE-2020-25869).
- Record
MGASA-2020-0381- Updated
- 2026-11-02
Affected products
Affected packages
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-25869 is a high vulnerability (CVSS 7.5) in Mediawiki, published September 27, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.41%, the 72nd percentile. Fixed in mediawiki 1.31.10.
References
phabricator.wikimedia.org/T260485
lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html
lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6
nvd.nist.gov/vuln/detail/CVE-2020-25869
Show 6 moreShow less
github.com/advisories/GHSA-7369-45qw-88c2
advisories.mageia.org/MGASA-2020-0381.html
bugs.mageia.org/show_bug.cgi?id=27331
debian.org/security/2020/dsa-4767