CVE-2020-15179

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2020-15179
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15179.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2020-15179
Aliases
  • GHSA-gp9v-pg9f-vmp6
Published
2020-09-15T18:15:14Z
Modified
2026-07-09T01:30:32.689505Z
Severity
  • 9.0 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using <script> tag inside <scratchsig> tag, attackers with edit permission can execute scripts on visitors' browser. With MediaWiki JavaScript API, this can potentially lead to privilege escalation and/or account takeover. This has been patched in release 1.0.1. This has already been deployed to all Scratch Wikis. No workarounds exist other than disabling the extension completely.

References

Affected packages

Git / github.com/internationalscratchwiki/wiki-scratchsig

Affected ranges

Type
GIT
Repo
https://github.com/internationalscratchwiki/wiki-scratchsig
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
44c6ff3128a340a68a86bb780ba75ca55dac068c
Fixed
4160a39a20eebeb63a59eb7597a91b961eca6388
Database specific 
{
    "cpe": "cpe:2.3:a:scratch-wiki:scratchsig:*:*:*:*:*:mediawiki:*:*",
    "source": [
        "CPE_RANGE",
        "REFERENCES"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "1.0.1"
        }
    ]
}

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2020-15179.json"