CVE-2020-10960 – mediawiki/core

Package

Manager: composer
Name: mediawiki/core
Vulnerable Version: >=1.31.0 <1.31.7 || >=1.33.0 <1.33.3 || >=1.34.0 <1.34.1

Severity

Level: Medium

CVSS v3.1: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

EPSS: 0.0031 pctl0.5359

Details

MediaWiki makeCollapsible allows applying event handler to any CSS selector In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler to any Cascading Style Sheets (CSS) selector. There is no known way to exploit this for cross-site scripting (XSS).

Metadata

Created: 2022-05-24T17:13:21Z
Modified: 2024-04-01T19:54:53Z
Source: https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-pfm2-mqwj-ggm5/GHSA-pfm2-mqwj-ggm5.json
CWE IDs: ["CWE-116", "CWE-74"]
Alternative ID: GHSA-pfm2-mqwj-ggm5
Finding: F184
Auto approve: 1