by Kastro
Paper/Archive/CVE-2020-15179

CVE-2020-15179

InternationalScratchWiki wiki-scratchsig — HTML Injection in ScratchSig

EPSS 1%CVSS 9.0
critical.is priorityof 100
41
CVSS 9.0 (NVD)9.0 / 10 × 3027.0Not in CISA KEV+300.0EPSS percentile 68.7.687 × 2013.7No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using <script> tag inside <scratchsig> tag, attackers with edit permission can execute scripts on visitors' browser. With MediaWiki JavaScript API, this can potentially lead to privilege escalation and/or account takeover. This has been patched in release 1.0.1. This has already been deployed to all Scratch Wikis. No workarounds exist other than disabling the extension completely.

Affected

ProductAffectedFixed inSource
wiki-scratchsig< 1.0.1–CNA

Scores by source

NVD9.0CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H
GitHub_M (CNA)8.0CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H

References

refgithub.com/InternationalScratchWiki/wiki-scratchsig/security/advisories/GHSA-gp9v-pg9f-vmp6refgithub.com/InternationalScratchWiki/wiki-scratchsig/commit/4160a39a20eebeb63a59eb7597a91b961eca6388