MediaWiki CSS Class Injection Vulnerability - CVE-2020-10960
Summary
CVE-2020-10960: In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki p... Affects mediawiki across 2 version ranges.
< 1:1.31.7-1
< 748c5eae2fd5d897c94c48771161c259941a7488
Fixed in 1:1.31.7-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MediaWiki is a free and open-source wiki software platform used to create and manage collaborative content. It is widely utilized by various organizations and communities for documentation and knowledge sharing. The software allows users to edit pages using a rich text editor and supports various extensions and customizations. However, prior to version 1.34.1, MediaWiki was vulnerable to a CSS class injection issue that could potentially affect the user interface.
Vulnerability Detail
In MediaWiki versions before 1.34.1, users were able to add arbitrary Cascading Style Sheets (CSS) classes to any DOM node through HTML content in a MediaWiki page. This vulnerability arises from the jquery.makeCollapsible function, which permits the application of event handlers to any CSS selector. While this issue does not currently have a known exploit for cross-site scripting (XSS), it poses a risk as it could allow users to manipulate the appearance and behavior of the user interface in unintended ways.
How To Fix
Minimum fixed version
1:1.31.7-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mediawikiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary measure, it is advisable to restrict user permissions to prevent untrusted users from editing pages or adding HTML content. This can be done by modifying user roles and permissions in the MediaWiki configuration settings.
Conclusion
CVE-2020-10960 represents a significant vulnerability in MediaWiki prior to version 1.34.1, allowing for CSS class injection that could alter the user interface. Users are strongly encouraged to upgrade to the latest version to mitigate this risk. Additionally, implementing user permission restrictions can serve as a temporary workaround until the upgrade is completed.
See every vulnerability recorded for mediawiki →
FAQ
CVE-2020-10960 is a vulnerability in MediaWiki that allows users to inject arbitrary CSS classes into DOM nodes via HTML content, potentially affecting the user interface.
You can check if your MediaWiki installation is affected by using the Vulert playground at Vulert Scanner, which allows you to monitor for open-source vulnerabilities without needing to sign up.
The primary risk is that users could manipulate the appearance and behavior of the MediaWiki interface, which could lead to confusion or misinformation among users.
Currently, there is no known exploit for cross-site scripting (XSS) related to this vulnerability, but it remains a concern for potential future exploitation.
The CVSS score for CVE-2020-10960 is 5.3, indicating a moderate level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki.
