CVE-2020-35475: 
NixOS vulnerability analysis and mitigation

In MediaWiki before 1.35.1, a cross-site scripting (XSS) vulnerability was discovered where the messages userrights-expiry-current and userrights-expiry-none could contain raw HTML. The vulnerability (CVE-2020-35475) was disclosed on December 18, 2020. XSS could occur when a user visits Special:UserRights but does not have rights to change all userrights, and the table on the left side has unchangeable groups in it (Wikimedia Advisory).

The vulnerability has a CVSS v3.1 Base Score of 7.5 (HIGH) with vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N. The issue specifically affects the left column with unchangeable groups in the Special:UserRights page, while the right column with changeable groups is properly escaped (NVD).

The vulnerability allows attackers to execute cross-site scripting attacks when users visit the Special:UserRights page. This could potentially lead to unauthorized access to sensitive information through the execution of malicious JavaScript code in the context of the victim's browser (NVD).

The vulnerability can be exploited when a user visits the Special:UserRights page without having full user rights management permissions. The attack vector is through the unescaped HTML content in the userrights-expiry-current and userrights-expiry-none messages (Wikimedia Advisory).

The vulnerability was fixed in MediaWiki version 1.35.1. Users are advised to upgrade to this version or later. For Debian systems, the fix was included in version 1:1.31.12-1~deb10u1 for the stable distribution (buster). Fedora users can update to mediawiki-1.35.1-1.fc33 (Debian Advisory, Fedora Update).