CVE-2020-29004: CSRF
The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF attack.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2020-29004?
CVE-2020-29004 is a vulnerability in the Push extension for MediaWiki through version 1.35 that allows for a CSRF attack due to a missing edit token in ApiPushBase.php.
How severe is CVE-2020-29004?
CVE-2020-29004 has a severity score of 8.8, which is considered high.
How does CVE-2020-29004 affect MediaWiki?
CVE-2020-29004 affects MediaWiki versions up to and including 1.35 that have the Push extension installed.
How can I fix CVE-2020-29004?
To fix CVE-2020-29004, users should upgrade their MediaWiki installations to a version that includes the necessary fix for the Push extension.
Where can I find more information about CVE-2020-29004?
More information about CVE-2020-29004 can be found in the provided references: https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Push/+/625988, https://phabricator.wikimedia.org/T262724.