{"id":"CVE-2020-10959","aliases":["BIT-mediawiki-2020-10959","GHSA-mqhw-wq8p-vf5r"],"url":"https://o3.security/vulnerability/CVE-2020-10959","summary":"MediaWiki Open Redirect vulnerability","details":"resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page.","published":"2020-06-02T14:15:10.507Z","modified":"2026-07-08T20:58:06.798441Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":{"score":0.01429,"percentile":0.71193,"asOf":"2026-09-03"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"mediawiki/core","fixedVersion":"1.34.0-rc.0"}],"fix":null,"references":[{"type":"FIX","url":"https://gerrit.wikimedia.org/r/c/mediawiki/core/+/536725"},{"type":"FIX","url":"https://phabricator.wikimedia.org/T232932"},{"type":"FIX","url":"https://phabricator.wikimedia.org/T240393"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-07-08T20:58:06.798441Z"}}