PT-2020-17373 · Wikimedia+2 · Mediawiki+2

Ashley · Published 2020-12-21 · Updated 2024-03-06 · CVE-2020-35626

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MediaWiki versions through 1.35.1 PushToWatch extension for MediaWiki versions through 1.35.1

Description An issue was discovered in the PushToWatch extension for MediaWiki. The primary form did not implement an anti-CSRF token, making it vulnerable to CSRF attacks against onSkinAddFooterLinks in PushToWatch.php.

Recommendations For MediaWiki versions through 1.35.1, consider implementing an anti-CSRF token in the primary form to prevent CSRF attacks. For the PushToWatch extension, restrict access to onSkinAddFooterLinks in PushToWatch.php until a patch is available. As a temporary workaround, consider disabling the onSkinAddFooterLinks function in PushToWatch.php to minimize the risk of exploitation.

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

ALT-PU-2021-1712

ALT-PU-2021-2091

BIT-MEDIAWIKI-2020-35626

CVE-2020-35626

Affected Products

Alt Linux

Mediawiki

Pushtowatch Extension

References · 6

• https://osv.dev/vulnerability/BIT-mediawiki-2020-35626 · Vendor Advisory
• https://gerrit.wikimedia.org/r/q/14dc79b1f44c2a1ca6b1192284206c7b8626fb57 · Patch
• https://osv.dev/vulnerability/CVE-2020-35626 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35626 · Security Note
• https://t.me/cvenotify/7519 · Telegram Post
• https://phabricator.wikimedia.org/T268641 · Note