CVE-2020-35625
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the ability to edit pages within the Widgets namespace could call any static function within any class (defined within PHP or MediaWiki) via a crafted HTML comment, related to a Smarty template. For example, a person in the Widget Editors group could use \MediaWiki\Shell\Shell::command within a comment.
Se detectó un problema en la extensión Widgets para MediaWiki versiones hasta 1.35.1. Cualquier usuario con la capacidad de editar páginas dentro del espacio de nombres de Widgets podría llamar a cualquier función estática dentro de cualquier clase (definida en PHP o MediaWiki) por medio de un comentario HTML diseñado, relacionado con una plantilla Smarty. Por ejemplo, una persona del grupo Widget Editors podría usar \MediaWiki\Shell\Shell::command dentro de un comentario
CVSS Scores
SSVC
- Decision:-
Timeline
- 2020-12-21 CVE Reserved
- 2020-12-21 CVE Published
- 2023-03-07 EPSS Updated
- 2024-08-04 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-862: Missing Authorization
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://gerrit.wikimedia.org/r/q/Ic899a8b15bc510e61cdacb5c024af2d226a2dbeb | Third Party Advisory | |
| https://phabricator.wikimedia.org/T269718 | Third Party Advisory |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Mediawiki Search vendor "Mediawiki" | Mediawiki Search vendor "Mediawiki" for product "Mediawiki" | <= 1.35.1 Search vendor "Mediawiki" for product "Mediawiki" and version " <= 1.35.1" | - |
Affected
| ||||||