CVE Feed

    Dashboard / CVE / CVE-2020-29007

    CVE-2020-29007

    The Score extension through 0.3.0 for MediaWiki has a remote code execution vulnerability due to improper sandboxing of the GNU LilyPond executable. This allows any user with an ability to edit articles (potentially including unauthenticated anonymous users) to execute arbitrary Scheme or shell code by using crafted {{Image data to generate musical scores containing malicious code.

    Published:Apr 15, 2023
    Last Modified:Feb 6, 2025
    EPS:Apr 15, 2023
    EPSS Score:0.05726
    CVSS Score:9.8

    Affected Products

    Vendor
    Mediawiki
    Product
    Score

    Exploits

    https://github.com/seqred-s-a/cve-2020-29007https://phabricator.wikimedia.org/T257062https://seqred.pl/en/cve-2020-29007-remote-code-execution-in-mediawiki-score/https://github.com/seqred-s-a/cve-2020-29007https://phabricator.wikimedia.org/T257062https://seqred.pl/en/cve-2020-29007-remote-code-execution-in-mediawiki-score/https://github.com/seqred-s-a/cve-2020-29007

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High