CVE-2020-27620

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

The Cosmos Skin for MediaWiki through 1.35.0 has stored XSS because MediaWiki messages were not being properly escaped. This is related to wfMessage and Html::rawElement, as demonstrated by CosmosSocialProfile::getUserGroups.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-79

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gerrit.wikimedia.org/r/c/mediawiki/skins/Cosmos/+/634749Vendor Advisory
https://gerrit.wikimedia.org/r/c/mediawiki/skins/Cosmos/+/634751Vendor Advisory
https://gerrit.wikimedia.org/r/c/mediawiki/skins/Cosmos/+/634752Vendor Advisory
https://phabricator.wikimedia.org/T265440Vendor Advisory
https://gerrit.wikimedia.org/r/c/mediawiki/skins/Cosmos/+/634749Vendor Advisory
https://gerrit.wikimedia.org/r/c/mediawiki/skins/Cosmos/+/634751Vendor Advisory
https://gerrit.wikimedia.org/r/c/mediawiki/skins/Cosmos/+/634752Vendor Advisory
https://phabricator.wikimedia.org/T265440Vendor Advisory

Timeline

Published: Oct 22, 2020
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2020

CVE-2020-276214.3The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. In CVE-2020-276225.3In JetBrains IntelliJ IDEA before 2020.2, the built-in web server could expose information about the IDE version.CVE-2020-276237.5JetBrains IdeaVim before version 0.58 might have caused an information leak in limited circumstances.CVE-2020-276245.3JetBrains YouTrack before 2020.3.888 was vulnerable to SSRF.CVE-2020-276255.3In JetBrains YouTrack before 2020.3.888, notifications might have mentioned inaccessible issues.CVE-2020-276265.3JetBrains YouTrack before 2020.3.5333 was vulnerable to SSRF.CVE-2020-276276.1JetBrains TeamCity before 2020.1.2 was vulnerable to URL injection.CVE-2020-276284.3In JetBrains TeamCity before 2020.1.5, the Guest user had access to audit records.CVE-2020-276295.3In JetBrains TeamCity before 2020.1.5, secure dependency parameters could be not masked in depending builds when there are no internal artif CVE-2020-27634.9Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: Replication). Supported versions that are affected are 5.6.47 CVE-2020-276309.8In Silicon Labs uC/TCP-IP 3.6.0, TCP ISNs are improperly random.CVE-2020-276319.8In Oryx CycloneTCP 1.9.6, TCP ISNs are improperly random.