CVE-2020-35625: 
NixOS vulnerability analysis and mitigation

An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the ability to edit pages within the Widgets namespace could call any static function within any class (defined within PHP or MediaWiki) via a crafted HTML comment, related to a Smarty template. For example, a person in the Widget Editors group could use \MediaWiki\Shell\Shell::command within a comment (NVD).

The vulnerability has a CVSS v3.1 Base Score of 8.8 HIGH with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. The issue stems from insufficient authorization controls in the Widgets extension, allowing users with Widget editing privileges to execute arbitrary static PHP functions through crafted HTML comments in Smarty templates (NVD).

Successful exploitation of this vulnerability could allow an attacker with Widget editing privileges to execute arbitrary static PHP functions, potentially leading to unauthorized access, data manipulation, and system compromise. The high CVSS score indicates severe potential impacts on confidentiality, integrity, and availability of the affected system (NVD).

Users should upgrade to a version of MediaWiki newer than 1.35.1 that contains the security fix. If immediate upgrade is not possible, it is recommended to carefully review and restrict access to the Widgets namespace (NVD).