PT-2020-20624 · Mediawiki+1 · Widgets Extension+1

Alexia · Published 2020-02-24 · Updated 2021-07-21 · CVE-2020-9382

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Widgets extension versions 1.4.0 and earlier

Description An issue was discovered in the Widgets extension for MediaWiki, where improper title sanitization allowed for the execution of any wiki page as a widget via MediaWiki's {{#widget:}} parser function.

Recommendations For versions 1.4.0 and earlier, consider disabling the {{#widget:}} parser function until a patch is available to prevent the execution of arbitrary wiki pages as widgets. Restrict access to the Widgets extension to minimize the risk of exploitation.

Exploit

Fix

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

ALT-PU-2021-2069

ALT-PU-2021-2092

CVE-2020-9382

Affected Products

Alt Linux

Widgets Extension

References · 5

• 🔥 https://phabricator.wikimedia.org/T245850 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2020-9382 · Security Note
• https://osv.dev/vulnerability/CVE-2020-9382 · Vendor Advisory
• https://gerrit.wikimedia.org/r/q/I953e060bc6994ffdba9f380c98173f53f8ca1ea8 · Patch
• https://t.me/cvenotify/1196 · Telegram Post