← All advisories

High severity8.8NVD Advisory· Published Jan 29, 2021· Updated Jun 17, 2026

CVE-2020-29004

CVE-2020-29004

Description

The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF attack.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

4

MediaWiki/Push extensionllm-create
Range: <=1.35
osv-coords
pkg:bitnami/mediawiki
Range: < 1.35.1
MediaWiki/Push extensiondescription
MediaWiki/Mediawiki
cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*
Range: <=1.35

Patches

Vulnerability mechanics

References

3

gerrit.wikimedia.org/r/c/mediawiki/extensions/Push/+/625988nvdPatchVendor Advisory
gerrit.wikimedia.org/r/c/mediawiki/extensions/Push/+/625988/10/src/api/ApiPushBase.phpnvdPatchVendor Advisory
phabricator.wikimedia.org/T262724nvdIssue TrackingPatchVendor Advisory

News mentions

0

No linked articles in our index yet.