CVE-2020-29004

The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF attack

published January 29, 2021

CVSS
—
EPSS
1%
Percentile
52.6
In the wild
Unconfirmed
What it is

The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF attack.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00701 · 52.6th percentile
Published
2021-01-29T06:22Z
EPSS history
Timeline
  • 29 JAN 06:22Z
    The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF attack
    cvelistv5