CVE-2020-35475

In MediaWiki before 1.35.1, the messages userrights-expiry-current and userrights-expiry-none can contain raw HTML. XSS can happen when a user visits Special:UserRights but does not have rights to change all userrights, and the table on the left side has unchangeable groups in it. (The right column with the changeable groups is not affected and is escaped correctly.)

• CWE-79

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STT5Z4A3BCXVH3WIPICWU2FP4IPIMUPC/
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December/000268.htmlMailing List, Release Notes, Vendor Advisory
• https://phabricator.wikimedia.org/T268917Issue Tracking, Third Party Advisory
• https://www.debian.org/security/2020/dsa-4816Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STT5Z4A3BCXVH3WIPICWU2FP4IPIMUPC/
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December/000268.htmlMailing List, Release Notes, Vendor Advisory
• https://phabricator.wikimedia.org/T268917Issue Tracking, Third Party Advisory
• https://www.debian.org/security/2020/dsa-4816Third Party Advisory

Published

Dec 18, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35469The Software AG Terracotta Server OSS Docker image 5.4.1 con…9.8
• CVE-2020-3547A vulnerability in the web-based management interface of Cis…6.5
• CVE-2020-35470Envoy before 1.16.1 logs an incorrect downstream address bec…8.8
• CVE-2020-35471Envoy before 1.16.1 mishandles dropped and truncated datagra…7.5
• CVE-2020-35473An information leakage vulnerability in the Bluetooth Low En…4.3
• CVE-2020-35474In MediaWiki before 1.35.1, the combination of Html::rawElem…6.1
• CVE-2020-35476A remote code execution vulnerability occurs in OpenTSDB thr…9.8
• CVE-2020-35477MediaWiki before 1.35.1 blocks legitimate attempts to hide l…5.3
• CVE-2020-35478MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php…6.1
• CVE-2020-35479MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php…6.1
• CVE-2020-3548A vulnerability in the Transport Layer Security (TLS) protoc…7.5
• CVE-2020-35480An issue was discovered in MediaWiki before 1.35.1. Missing …5.3