CVE-2020-25827

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

An issue was discovered in the OATHAuth extension in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. For Wikis using OATHAuth on a farm/cluster (such as via CentralAuth), rate limiting of OATH tokens is only done on a single site level. Thus, multiple requests can be made across many wikis/sites concurrently.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-307

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.htmlMailing List, Vendor Advisory
https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.htmlMailing List, Vendor Advisory
https://phabricator.wikimedia.org/T251661Exploit, Vendor Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.htmlMailing List, Vendor Advisory
https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.htmlMailing List, Vendor Advisory
https://phabricator.wikimedia.org/T251661Exploit, Vendor Advisory

Timeline

Published: Sep 27, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-258286.1An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse CVE-2020-258297.5An issue has been found in PowerDNS Recursor before 4.1.18, 4.2.x before 4.2.5, and 4.3.x before 4.3.5. A remote attacker can cause the cach CVE-2020-25833.7Vulnerability in the Java SE, Java SE Embedded product of Oracle Java SE (component: Serialization). Supported versions that are affected ar CVE-2020-258304.8An issue was discovered in MantisBT before 2.24.3. Improper escaping of a custom field's name allows an attacker to inject HTML and, if CSP CVE-2020-258325.4Reflected Cross Site scripting vulnerability on Micro Focus Filr product, affecting version 4.2.1. The vulnerability could be exploited to p CVE-2020-258334.8Persistent cross-Site Scripting vulnerability on Micro Focus IDOL product, affecting all version prior to version 12.7. The vulnerability co CVE-2020-258345.4Cross-Site Scripting vulnerability on Micro Focus ArcSight Logger product, affecting version 7.1. The vulnerability could be remotely exploi CVE-2020-258355.4A potential vulnerability has been identified in Micro Focus ArcSight Management Center. The vulnerability could be remotely exploited resul CVE-2020-258366.3Exposure of Sensitive Information to an Unauthorized Access vulnerability in OpenText NetIQ Directory and Resource Administrator. This issue CVE-2020-258377.5Sensitive information disclosure vulnerability in Micro Focus Self Service Password Reset (SSPR) product. The vulnerability affects versions CVE-2020-258386.5Unauthorized disclosure of sensitive information vulnerability in Micro Focus Filr product. Affecting all 3.x and 4.x versions. The vulnerab CVE-2020-258399.8NetIQ Identity Manager 4.8 prior to version 4.8 SP2 HF1 are affected by an injection vulnerability. This vulnerability is fixed in NetIQ IdM