PT-2020-16299 · Mediawiki+2 · Mediawiki Mobilefrontend Extension+2

Paser24 · Published 2020-09-27 · Updated 2024-03-06 · CVE-2020-26120

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki MobileFrontend extension versions prior to 1.34.4

Description The issue exists due to the mishandling of section.line during regex section line replacement from PageGateway. An attacker can exploit this by using crafted HTML to elicit an XSS attack via jQuery's parseHTML method. This can cause image callbacks to fire even without the element being appended to the DOM.

Recommendations For versions prior to 1.34.4, update to version 1.34.4 or later to resolve the issue. As a temporary workaround, consider restricting the use of jQuery's parseHTML method until a patch is applied.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

ALT-PU-2020-3022

ALT-PU-2020-3055

BIT-MEDIAWIKI-2020-26120

CVE-2020-26120

Affected Products

Alt Linux

Mediawiki Mobilefrontend Extension

Jquery

References · 6

• 🔥 https://phabricator.wikimedia.org/T262213 · Exploit
• https://gerrit.wikimedia.org/r/q/I42e079bc875d17b336ab015f3678eaedc26e10ea · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-26120 · Security Note
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mediawiki-2020-26120 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-26120 · Vendor Advisory