Security readout for executives and security teams
Plain-English summary
CVE-2020-36324 is a reflected cross-site scripting issue in Wikimedia Quarry analytics-quarry-web before 2020-12-15. A browser could treat JSON-like output as executable content because app.py did not explicitly set application/json. Business impact is mainly user-session and trust risk for exposed Quarry deployments.
Executive priority
Treat this as a moderate web application remediation item. It is not supported as actively exploited, but public-facing XSS can affect user trust and authenticated sessions.
Technical view
The flaw is in analytics-quarry-web app.py response handling. Missing explicit application/json content type allowed reflected XSS behavior before the 2020-12-15 fix reference. The source bundle provides no CVSS, CWE, affected CPEs, or detailed exploitability data.
Likely exposure
Exposure is most likely for organizations running Wikimedia Quarry analytics-quarry-web code older than 2020-12-15, especially internet-facing deployments. The bundle does not establish exposure for current quarry.wmflabs.org.
Exploitation context
No CISA KEV listing is provided and the supplied sources do not cite active exploitation. Reflected XSS usually depends on user interaction and browser handling, but this bundle does not provide exploit prerequisites or observed attacks.
Researcher notes
The record is sparse: no CVSS, CWE, CPE, exploit evidence, or affected version range beyond before 2020-12-15. Analysis should remain tied to the CVE description and the referenced Wikimedia commit.
Mitigation direction
- Review and apply the referenced Wikimedia fix commit or a release containing it.
- Ensure JSON responses explicitly set the application/json content type.
- Check Wikimedia project guidance for any later recommended upgrade path.
- Prioritize remediation for public or authenticated-user-facing Quarry instances.
Validation and detection
- Inventory any analytics-quarry-web deployments, forks, or containers.
- Confirm deployed code is from 2020-12-15 or later.
- Review app.py response paths for explicit application/json headers.
- Check web logs for suspicious reflected script-like input patterns.
- Validate behavior in staging with a safe XSS scanner.
Public sources used
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2020-36324 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://quarry.wmflabs.org/CVE reference · x_refsource_MISC
- https://github.com/wikimedia/analytics-quarry-web/commit/4b7e1d6a3a52ec6cf826a971135a38b0f74785d2CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.