Beveiligingsadvies

CVE-2020-35625

CVE-kwetsbaarheidsdetails - eXtreme Datacenter Security Operations

Gepubliceerd 2020-12-21 22:36:26

Laatst bijgewerkt 2024-08-04 17:09:14

Toegewezen door mitre

CVSS-score geen score

Status PUBLISHED

Beschrijving

An issue was discovered in the Widgets extension for MediaWiki through 1.35.1. Any user with the ability to edit pages within the Widgets namespace could call any static function within any class (defined within PHP or MediaWiki) via a crafted HTML comment, related to a Smarty template. For example, a person in the Widget Editors group could use \MediaWiki\Shell\Shell::command within a comment.

← Alle CVE's bekijken Bekijk op cve.org ↗