Description
The API in the Push extension for MediaWiki through 1.35 did not require an edit token in ApiPushBase.php and therefore facilitated a CSRF attack.
Remediation
References
Related Vulnerabilities
WordPress Plugin Affiliate Ads for Clickbank Products Cross-Site Scripting (1.6)
WordPress Plugin WP Server Log Viewer Cross-Site Scripting (1.0)
WordPress 3.9.x Multiple Vulnerabilities (3.9 - 3.9.16)
WordPress Plugin Vertical News Scroller Unspecified Vulnerability (1.19)
PHP Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-7890)