{"id":"CVE-2020-15179","aliases":["EUVD-2020-7247","GHSA-gp9v-pg9f-vmp6"],"status":"published","title":"HTML Injection in ScratchSig","description":"The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using \u003cscript\u003e tag inside \u003cscratchsig\u003e tag, attackers with edit permission can execute scripts on visitors' browser. With MediaWiki JavaScript API, this can potentially lead to privilege escalation and/or account takeover. This has been patched in release 1.0.1. This has already been deployed to all Scratch Wikis. No workarounds exist other than disabling the extension completely.","severity":{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.0122,"percentile":0.69087,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2020-09-15T18:10:13Z","modified":"2026-10-20T10:51:52Z","products":[{"vendor":"internationalscratchwiki","product":"wiki-scratchsig"},{"vendor":"scratch-wiki","product":"scratchsig"}],"references":[{"url":"https://github.com/InternationalScratchWiki/wiki-scratchsig/security/advisories/GHSA-gp9v-pg9f-vmp6","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/InternationalScratchWiki/wiki-scratchsig/commit/4160a39a20eebeb63a59eb7597a91b961eca6388","tags":["x_refsource_MISC","x_transferred","Patch","Third Party Advisory","fix"]}],"sources":{"cve":[{"id":"CVE-2020-15179","title":"HTML Injection in ScratchSig","description":"The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using \u003cscript\u003e tag inside \u003cscratchsig\u003e tag, attackers with edit permission can execute scripts on visitors' browser. With MediaWiki JavaScript API, this can potentially lead to privilege escalation and/or account takeover. This has been patched in release 1.0.1. This has already been deployed to all Scratch Wikis. No workarounds exist other than disabling the extension completely.","status":"published","published":"2020-09-15T18:10:13Z","modified":"2024-08-04T13:08:22.438Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:35:49.879248Z"}],"euvd":[{"id":"EUVD-2020-7247","description":"The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using \u003cscript\u003e tag inside \u003cscratchsig\u003e tag, attackers with edit permission can execute scripts on visitors' browser. With MediaWiki JavaScript API, this can potentially lead to privilege escalation and/or account takeover. This has been patched in release 1.0.1. This has already been deployed to all Scratch Wikis. No workarounds exist other than disabling the extension completely.","status":"published","published":"2020-09-15T18:10:13Z","modified":"2024-08-04T13:08:22Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-03T03:07:32.55679Z"}],"nvd":[{"id":"CVE-2020-15179","description":"The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using \u003cscript\u003e tag inside \u003cscratchsig\u003e tag, attackers with edit permission can execute scripts on visitors' browser. With MediaWiki JavaScript API, this can potentially lead to privilege escalation and/or account takeover. This has been patched in release 1.0.1. This has already been deployed to all Scratch Wikis. No workarounds exist other than disabling the extension completely.","status":"published","published":"2020-09-15T18:15:14Z","modified":"2026-06-17T02:56:12.483Z","cvss":[{"version":"3.1","score":8,"vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical","assessor":"primary"},{"version":"2.0","score":4.6,"vector":"AV:N/AC:H/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:06:14.981587Z"}],"osv":[{"id":"CVE-2020-15179","description":"The ScratchSig extension for MediaWiki before version 1.0.1 allows stored Cross-Site Scripting. Using \u003cscript\u003e tag inside \u003cscratchsig\u003e tag, attackers with edit permission can execute scripts on visitors' browser. With MediaWiki JavaScript API, this can potentially lead to privilege escalation and/or account takeover. This has been patched in release 1.0.1. This has already been deployed to all Scratch Wikis. No workarounds exist other than disabling the extension completely.","status":"published","published":"2020-09-15T18:15:14Z","modified":"2026-10-20T10:51:52.868013058Z","cvss":[{"version":"3.1","score":9,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:44:14.828228Z"}]}}