An issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don't exist) and hidden users (accounts that have been explicitly hidden due to being abusive, or similar) that the viewer cannot see are handled differently, exposing sensitive information about the hidden status to unprivileged viewers. This exists on various code paths.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2020-35480US | medium5.3 | — | ||
An issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don't exist) and hidden users (accounts that have been explicitly hidden due to being abusive, or s… | ||||
02
references
External citations — patches, advisories, analysis.
- https://lists.debian.org/debian-lts-announce/2020/12/msg00034.htmlWEB
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STT5Z4A3BCXVH3WIPICWU2FP4IPIMUPC/WEB
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December/000268.htmlWEB
- https://nvd.nist.gov/vuln/detail/CVE-2020-35480WEB
- https://phabricator.wikimedia.org/T120883WEB
- https://www.debian.org/security/2020/dsa-4816WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan