CVE-2020-10959

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.35 MediaWiki versions prior to 1.34.0-rc.0

Description The issue allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page. This is achieved by exploiting the resources/src/mediawiki.page.ready/ready.js file in MediaWiki.

Recommendations For MediaWiki versions prior to 1.35, update to version 1.35 or later to resolve the issue. For MediaWiki versions prior to 1.34.0-rc.0, update to version 1.34.0-rc.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the resources/src/mediawiki.page.ready/ready.js file until a patch is available.