Improper Encoding or Escaping of Output Affecting mediawiki/core package, versions >=1.31.0, <1.31.7 >=1.33.0, <1.33.3 >=1.34.0, <1.34.1
Snyk CVSS
Threat Intelligence
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-PHP-MEDIAWIKICORE-1019460
- published 20 Oct 2020
- disclosed 20 Oct 2020
- credit Unknown
Introduced: 20 Oct 2020
CVE-2020-10960 Open this link in a new tabHow to fix?
Upgrade mediawiki/core
to version 1.31.7, 1.33.3, 1.34.1 or higher.
Overview
mediawiki/core is a Free software wiki application developed by the Wikimedia Foundation and others.
Note: This package is not maintained on Packagist
anymore, but newer releases exist.
Affected versions of this package are vulnerable to Improper Encoding or Escaping of Output. Users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible
allows applying an event handler to any Cascading Style Sheets (CSS) selector.