CVE-2020-29004

—

CVSS 3.1

8.8 high

EPSS

<1%p51

Published

Jan 29, 2021 (Jan 29, 2021)

Modified

Jun 17, 2026

Description

The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF attack.

Vendors: mediawiki
Products: mediawiki
Weakness: CWE-352
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

NVD CVE.org GitHub PoCs EPSS (0.7%)

In the news0 stories

No ingested article mentions this CVE yet.