An issue was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. The non-jqueryMsg version of mw.message().parse() doesn't escape HTML. This affects both message contents (which are generally safe) and the parameters (which can be based on user input). (When jqueryMsg is loaded, it correctly accepts only whitelisted tags in message contents, and escapes all parameters. Situations with an unloaded jqueryMsg are rare in practice, but can for example occur for Special:SpecialPages on a wiki with no extensions installed.) References: https://lists.wikimedia.org/pipermail/mediawiki-announce https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html
Created mediawiki tracking bugs for this issue: Affects: fedora-all [bug 1903778]
Upstream commit: https://github.com/wikimedia/mediawiki/commit/d0b7fb495c9d5446607672ad6a93a5491efe7337
Statement: OpenShift Container Platform (OCP) delivers the mediawiki package, but the vulnerable code is not bundled, therefore OCP is not affected by this flaw.
External References: https://phabricator.wikimedia.org/T115888
This bug is now closed. Further updates for individual products will be reflected on the CVE page(s): https://access.redhat.com/security/cve/cve-2020-25828