PT-2020-17080

CVE-2020-29002

Published

2020-10-10

Updated

2024-03-06

Description by

CVSS 3.1

4.8

Medium

MetricsAV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions through 1.35

Description The issue allows for XSS via a qbfind message supplied by an administrator in the CologneBlue skin. This can be exploited when an administrator supplies a malicious qbfind message.

Recommendations For versions through 1.35, update to a version that contains a fix for this issue to prevent XSS exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploitability

Exploit

Impacts

Researchers

Daimona

Vendors

Affected products

Weakness enumeration

CWE-79: Improper Neutralization of Input During Web Page Generation (\'Cross-site Scripting\')

Related identifiers

CVE-2020-29002

ALT-PU-2020-3022