CVE-2020-35623

Katalog CVE

CVSS 7.5 · High EPSS 1,1%

Kerentanan Improper Input Validation pada mediawiki. Skor CVSS 3.1 7.5 (High) menurut NVD.

Deskripsi (NVD)

An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a similar username, as demonstrated by usernames that differ only in (1) bidirectional override symbols or (2) blank space.

Rincian

Terbit di NVD

21 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.5 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-20: Improper Input Validation
CWE-706: Use of Incorrectly-Resolved Name or Reference

EPSS (30 hari)

1,1% peluang dieksploitasi; lebih tinggi dari 64,6% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/CWRUChielLab/CASAuth/pull/11 patch · advisory pihak ketiga
• https://phabricator.wikimedia.org/T263498 exploit · advisory pihak ketiga