CVE-2020-10959 MediaWiki Open Redirect vulnerability

What is CVE-2020-10959?

CVE-2020-10959 is a medium-severity vulnerability in Mediawiki Mediawiki, published on 2 Jun 2020. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page.

Weakness: CWE-601

Which versions are affected by CVE-2020-10959?

3 open source packages ship an affected version, including mediawiki/core and mediawiki. It affects 1 product.

Products include Mediawiki Mediawiki.

How do I fix CVE-2020-10959?

Upgrade mediawiki/core to 1.34.0-rc.0 or later.

Is CVE-2020-10959 being exploited?

There is no known exploitation of CVE-2020-10959 in the wild and no public exploit code.

Other vulnerabilities in Mediawiki Mediawiki

• CVE-2023-37303 Denial of service in n/a Critical 9.8
• CVE-2022-29904 SQL injection in n/a Critical 9.8
• CVE-2022-29906 Missing authorization in n/a Critical 9.8
• CVE-2022-28205 Business logic in n/a Critical 9.8
• CVE-2022-28206 Missing authorization in n/a Critical 9.8

All Mediawiki Mediawiki vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-mediawiki-2020-10959, GHSA-mqhw-wq8p-vf5r.