{"id":"CVE-2020-10959","aliases":["BIT-mediawiki-2020-10959","GHSA-mqhw-wq8p-vf5r"],"url":"https://o3.security/vulnerability/CVE-2020-10959","summary":"MediaWiki Open Redirect vulnerability","details":"resources/src/mediawiki.page.ready/ready.js in MediaWiki before 1.35 allows remote attackers to force a logout and external redirection via HTML content in a MediaWiki page.","published":"2020-06-02T14:15:10.507Z","modified":"2026-10-24T10:30:21.166289363Z","cvss":{"score":6.1,"severity":"MEDIUM","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"},"epss":{"score":0.01429,"percentile":0.71193,"asOf":"2026-09-03"},"cisaKev":null,"exploitsKnown":1,"affectedPackages":[{"ecosystem":"Packagist","name":"mediawiki/core","fixedVersion":"1.34.0-rc.0"}],"fix":{"url":"https://github.com/wikimedia/mediawiki/commit/d4a552e65bdfd7309a9b8537e9dbe69c5e2991eb","label":"wikimedia/mediawiki@d4a552e"},"references":[{"type":"FIX","url":"https://gerrit.wikimedia.org/r/c/mediawiki/core/+/536725"},{"type":"FIX","url":"https://phabricator.wikimedia.org/T232932"},{"type":"FIX","url":"https://phabricator.wikimedia.org/T240393"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2020-10959"},{"type":"WEB","url":"https://github.com/wikimedia/mediawiki/commit/d4a552e65bdfd7309a9b8537e9dbe69c5e2991eb"},{"type":"WEB","url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2020-10959.yaml"},{"type":"PACKAGE","url":"https://github.com/wikimedia/mediawiki"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-10-24T10:30:21.166289363Z"}}