PT-2020-12450

CVE-2020-10959

Published

2020-06-02

Updated

2024-03-06

Description by

CVSS 3.1

6.1

Medium

MetricsAV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.35 MediaWiki versions prior to 1.34.0-rc.0

Description The issue allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page. This is achieved by exploiting the resources/src/mediawiki.page.ready/ready.js file in MediaWiki.

Recommendations For MediaWiki versions prior to 1.35, update to version 1.35 or later to resolve the issue. For MediaWiki versions prior to 1.34.0-rc.0, update to version 1.34.0-rc.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the resources/src/mediawiki.page.ready/ready.js file until a patch is available.

Exploitability

Exploit

Fix

Impacts

Researchers

Sbassett

Vendors

Affected products

Weakness enumeration

CWE-601: URL Redirection to Untrusted Site (\'Open Redirect\')

Related identifiers

CVE-2020-10959