CVE-2020-10960: MediaWiki/core - Arbitrary CSS Selector Event Handler Vulnerability
Summary
CVE-2020-10960: MediaWiki makeCollapsible allows applying event handler to any CSS selector. Affects mediawiki/core across 3 version ranges.
>= 1.31.0, < 1.31.7
>= 1.33.0, < 1.33.3
>= 1.34.0, < 1.34.1
Fixed in 1.31.7, 1.33.3 or 1.34.1, depending on the release line you run. How to fix ↓
Also tracked for
The same CVE-2020-10960 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MediaWiki/core is an open-source software package that powers Wikipedia and other Wikimedia Foundation websites. It provides a platform for collaborative editing and managing of content. The package allows users to add CSS classes to DOM nodes via HTML content within a MediaWiki page. This feature enables customization of the user interface by showing or hiding specific content based on the applied CSS classes.
Vulnerability Detail
The vulnerability (CVE-2020-10960) in MediaWiki/core versions before 1.34.1 allows users to apply an event handler to any CSS selector. This means that arbitrary DOM nodes can have event handlers attached to them, potentially leading to unintended behavior or security issues. Although there is no known way to exploit this vulnerability for cross-site scripting (XSS), it can still have implications on the functionality and user experience of the application.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.31.0, < 1.31.71.31.7composer require mediawiki/core:1.31.7 -
>= 1.33.0, < 1.33.31.33.3composer require mediawiki/core:1.33.3 -
>= 1.34.0, < 1.34.11.34.1composer require mediawiki/core:1.34.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The vulnerability in MediaWiki/core versions before 1.34.1 allows users to apply event handlers to arbitrary CSS selectors, potentially leading to unintended behavior or security issues. It is recommended to update to the latest version to mitigate the risk. For further support on vulnerability remediation, contact DevNack.com.
See every vulnerability recorded for mediawiki/core →
FAQ
MediaWiki/core is an open-source software package used for collaborative editing and managing of content, powering Wikipedia and other Wikimedia Foundation websites.
The vulnerability allows users to apply event handlers to arbitrary CSS selectors, potentially leading to unintended behavior or security issues in the application.
No, there is no known way to exploit this vulnerability for cross-site scripting (XSS).
To fix this vulnerability, update MediaWiki/core to version 1.34.1 or later.
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki/core.
