CVE-2020-35626: CSRF
An issue was discovered in the PushToWatch extension for MediaWiki through 1.35.1. The primary form did not implement an anti-CSRF token and therefore was completely vulnerable to CSRF attacks against onSkinAddFooterLinks in PushToWatch.php.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2020-35626?
CVE-2020-35626 has a medium severity rating due to its potential for exploitation through CSRF attacks.
How do I fix CVE-2020-35626?
To fix CVE-2020-35626, upgrade to a version of MediaWiki higher than 1.35.1 where the anti-CSRF token is implemented.
What does CVE-2020-35626 affect?
CVE-2020-35626 affects the PushToWatch extension for MediaWiki versions up to 1.35.1.
What is the nature of the vulnerability in CVE-2020-35626?
CVE-2020-35626 is a cross-site request forgery (CSRF) vulnerability due to the lack of an anti-CSRF token.
Is CVE-2020-35626 still a risk if I am using an updated version of MediaWiki?
If you are using a version of MediaWiki higher than 1.35.1, CVE-2020-35626 should not pose a risk.