resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a
    logout and external redirection via HTML content in a MediaWiki page. (CVE-2020-10959)

According to its self-reported version number, the instance of MediaWiki hosted on the remote web server is prior to 1.35. It is, therefore, affected by multiple vulnerabilities:

- A vulnerability in the default Cologne Blue skin in the qbfind paramter inside CologneBlueTemplate.php leading to cross site scripting (XSS).

- A Flaw in the WikibaseMediainfo extension inside the PropertySuggestionsWigid.mustache+dom template file leading to cross site scripting (XSS).

- A Vulnerability in mediawiki.page.ready/ready.js which permits remote attackers to force a logout and external redirection via HTML content in a MediaWiki page.

Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
434162	SCA: security update for mediawiki/core (GHSA-mqhw-wq8p-vf5r)	Tenable Cloud Security	SCA Checks	medium
434162	SCA: security update for mediawiki/core (GHSA-mqhw-wq8p-vf5r)	Tenable Self-Hosted Container Security	SCA Checks	medium
113999	MediaWiki < 1.35.0 Multiple Vulnerabilities	Web App Scanning	Component Vulnerability	medium

Detections

Analytics

CVE-2020-10959

medium

Tenable Plugins

medium

medium

medium