In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler to any Cascading Style Sheets (CSS) selector. There is no known way to exploit this for cross-site scripting (XSS).

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect
    what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a
    MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler to any
    Cascading Style Sheets (CSS) selector. There is no known way to exploit this for cross-site scripting
    (XSS). (CVE-2020-10960)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect     what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a     MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler to any     Cascading Style Sheets (CSS) selector. There is no known way to exploit this for cross-site scripting     (XSS). (CVE-2020-10960)

Note that Nessus relies on the presence of the package as reported by the vendor.

It was discovered that some user-generated CSS selectors in MediaWiki, a website engine for collaborative work, were not escaped.

The oldstable distribution (stretch) is not affected.

ID	Name	Product	Family	Severity
434983	SCA: security update for mediawiki/core (GHSA-pfm2-mqwj-ggm5)	Tenable Cloud Security	SCA Checks	medium
434983	SCA: security update for mediawiki/core (GHSA-pfm2-mqwj-ggm5)	Tenable Self-Hosted Container Security	SCA Checks	medium
249991	Linux Distros Unpatched Vulnerability : CVE-2020-10960	Nessus	Misc.	medium
135206	Debian DSA-4651-1 : mediawiki - security update	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2020-10960

medium

Tenable Plugins

medium

medium

medium

medium