| Package | Affected versions | Patched versions |
|---|---|---|
| mediawiki | ≤ 1.35 |
The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF attack.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free