CVE-2020-29002: 
NixOS vulnerability analysis and mitigation

The vulnerability (CVE-2020-29002) affects the CologneBlue skin component in MediaWiki through version 1.35. The issue allows Cross-Site Scripting (XSS) attacks via a qbfind message that can be supplied by an administrator (CVE Details, NVD).

The vulnerability has been assigned a CVSS v3.1 Base Score of 4.8 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N. This indicates that the vulnerability requires high privileges (administrator access) and user interaction to exploit, with potential impact on confidentiality and integrity but not availability. The vulnerability is classified as CWE-79: Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) (NVD).

The successful exploitation of this vulnerability could allow an attacker with administrator privileges to execute cross-site scripting attacks, potentially leading to the disclosure of sensitive information or manipulation of web content (NVD).

The vulnerability requires administrator privileges to exploit, making it less severe than typical XSS vulnerabilities. The attack vector is through the qbfind message parameter in the CologneBlue skin component (CVE Details).

A patch has been provided to address this vulnerability. Users should upgrade to a version of MediaWiki that includes the fix (Wikimedia Patch).