Security readout for executives and security teams
Plain-English summary
This is a cross-site scripting issue in the CologneBlue skin for MediaWiki through 1.35. The reported path requires a malicious or compromised administrator to supply a crafted qbfind message. Business urgency is mainly around public wikis that still use CologneBlue and have privileged accounts that can alter interface messages.
Executive priority
Treat this as a targeted web-application hygiene issue, not a broad emergency based on the supplied evidence. Prioritize public wikis using CologneBlue, especially where administrator accounts are shared, weakly protected, or historically compromised.
Technical view
The CVE identifies XSS in includes/CologneBlueTemplate.php in the CologneBlue skin, triggered through the qbfind message when supplied by an administrator. The source bundle provides no CVSS, CWE, exploit proof, or detailed patch statement. Exposure depends on MediaWiki version, CologneBlue use, and administrative control of that message.
Likely exposure
Most likely exposed systems are MediaWiki installations through 1.35 using the CologneBlue skin. Risk is lower where CologneBlue is disabled or absent. The known path depends on administrator-supplied content, so compromised or overly broad admin privileges matter.
Exploitation context
The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The described prerequisite is administrator-supplied qbfind content, suggesting abuse would likely involve a malicious admin, compromised admin account, or unsafe administrative change process.
Researcher notes
The public bundle is thin: no CVSS, CWE, detailed affected CPEs, or explicit exploit status are provided. The strongest facts are the MediaWiki CologneBlue component, qbfind message vector, administrator prerequisite, and references to Wikimedia Phabricator and Gerrit.
Mitigation direction
- Check Wikimedia vendor guidance and linked Gerrit change for the applicable fixed version.
- Upgrade MediaWiki and the CologneBlue skin according to official Wikimedia guidance.
- Disable CologneBlue if it is unnecessary or unsupported in your deployment.
- Review and restrict who can edit interface messages or skin-related configuration.
- Audit qbfind and related interface messages for unexpected script-capable content.
Validation and detection
- Inventory MediaWiki versions and identify any installations through 1.35.
- Confirm whether the CologneBlue skin is installed and enabled.
- Review administrative message changes involving qbfind.
- Check privileged account activity for suspicious interface-message edits.
- Verify remediation against the linked Wikimedia task and Gerrit references.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-29002 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://phabricator.wikimedia.org/T267278CVE reference · x_refsource_MISC
- https://gerrit.wikimedia.org/r/q/Ie798a4f16d0ac2a4871aefeb593d962966aeb6b0CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.