GitHub Advisoryadvisory · Packagist

GHSA-mqhw-wq8p-vf5r MediaWiki Open Redirect vulnerability

MEDIUM Published 2022-05-24 Modified 2024-05-15 Official page ↗
Aliases
CVE-2020-10959
Ecosystem
Packagist
Packages
mediawiki/core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2024-05-15

Affected packages

• Packagist mediawiki/core: < 1.34.0-rc.0 → fixed in 1.34.0-rc.0

Description

resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.34.0-rc.0 allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page.

Related

Alias · CVE (1)

  • CVE-2020-10959 resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References