CVE-2020-15179: scratch-wiki scratchsig

csirt@kutim:~/threat-intel/cve/CVE-2020-15179

CVSS 9.0 · Critical EPSS 1,2%

Kerentanan Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') pada scratch-wiki scratchsig. Skor CVSS 3.1 9.0 (Critical) menurut NVD.

Deskripsi (NVD)

The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using <script> tag inside <scratchsig> tag, attackers with edit permission can execute scripts on visitors' browser. With MediaWiki JavaScript API, this can potentially lead to privilege escalation and/or account takeover. This has been patched in release 1.0.1. This has already been deployed to all Scratch Wikis. No workarounds exist other than disabling the extension completely.

Rincian

Terbit di NVD: 15 September 2020
Terakhir diubah: 17 Juni 2026
Status NVD: Modified
CVSS 3.1: 9.0 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H · uraikan di kalkulator
Jenis kelemahan (CWE): CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
EPSS (30 hari): 1,2% peluang dieksploitasi; lebih tinggi dari 67,9% CVE lain

Produk dan versi terdampak

Vendor	Produk	Versi terdampak
scratch-wiki	scratchsig	Semua versi sebelum 1.0.1

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

https://github.com/InternationalScratchWiki/wiki-scratchsig/commit/4160a39a20eebeb63a59eb7597a91b961eca6388 patch · advisory pihak ketiga
https://github.com/InternationalScratchWiki/wiki-scratchsig/security/advisories/GHSA-gp9v-pg9f-vmp6 advisory pihak ketiga

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:10 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.