Skip to content
Fencer Vulns
medium 4.3

CVE-2020-27621 json

The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address.

published 2020-10-22 6 y ago modified 2026-06-17 4 mo ago also BIT-mediawiki-2020-27621 , EUVD-2020-20128

cvss
4.3
version 3.1, NVD
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 53%
public exploits
0
none known

Summary

The FileImporter extension in MediaWiki through 1.35.0 was not properly attributing various user actions to a specific user's IP address. Instead, for various actions, it would report the IP address of an internal Wikimedia Foundation server by omitting X-Forwarded-For data. This resulted in an inability to properly audit and attribute various user actions performed via the FileImporter extension.

Patch / fix

  • bitnami mediawiki 1.35.1

Exploit prediction

0.71% chance of exploitation in the next 30 days, higher than 53% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • phabricator.wikimedia.org https://phabricator.wikimedia.org/T265810 referenced PoC, tagged "exploit" by a source, unverified
  • gerrit.wikimedia.org https://gerrit.wikimedia.org/r/q/I24a240253c7a5c66dd493a68e8c23d95a17e1b21 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
NVD 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
NVD 2.0 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N
OSV 3.1 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Affected packages

ecosystem package affected fixed in
bitnami mediawiki
<1.35.1
1.35.1

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.