Vulnerability · Published Sep 27, 2020 · Assigned by mitre
CVE-2020-26120
Medium 6.1
In plain English
A medium-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 62% of all known vulnerabilities).
Severity (CVSS NVD)6.1Medium
Exploit odds (30 days)1.0%top 37.6% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
XSS exists in the MobileFrontend extension for MediaWiki before 1.34.4 because section.line is mishandled during regex section line replacement from PageGateway. Using crafted HTML, an attacker can elicit an XSS attack via jQuery's parseHTML method, which can cause image callbacks to fire even without the element being appended to the DOM.
Affected products (as reported)
References
- https://phabricator.wikimedia.org/T262213 x_refsource_MISC
- https://gerrit.wikimedia.org/r/q/I42e079bc875d17b336ab015f3678eaedc26e10ea x_refsource_MISC
- FEDORA-2020-a4802c53d9 vendor-advisory, x_refsource_FEDORA