Description
The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF attack.
Unscored
CVE-2020-29004
EUVD-2020-21386GHSA-m989-hhx2-g8c7
The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF …
Published Jan 29, 2021 · Updated Aug 4, 2024 · Assigned by mitre