CVE Vulnerability

CVE-2020-10960

In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler to any Cascading Style Sheets (CSS) selector. There is no known way to exploit this for cross-site scripting (XSS).

5 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 2.9

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

Scope

5.3 /10

CVSS v3.0 : MEDIUM

V3 Legend

Vector :

Exploitability : 3.9 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

References
Link Resource
https://phabricator.wikimedia.org/T246602 Exploit Vendor Advisory
https://lists.wikimedia.org/pipermail/wikitech-l/2020-March/093243.html Mailing List Patch
Configurations

Configuration 1

cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*
Information

Published : 2020-04-03 03:15

Updated : 2021-07-21 11:39

NVD link : CVE-2020-10960

Mitre link : CVE-2020-10960

Products Affected
No products.
CWE
CWE-74