CVE-2020-35623
HIGH WAF: Medium
CVSS 7.5
Published: 2020-12-21
CWE-20
An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a similar username, as demonstrated by usernames that differ only in (1) bidirectional override symbols or (2) blank space.
WAF Coverage Analysis
Improper Input Validation
Medium WAF Coverage
OWASP: A03:2021 Injection
920xxx - Protocol Enforcement 941xxx - XSS / XXE 942xxx - SQL Injection
Affected Software
| Vendor | Product | Version |
|---|---|---|
| mediawiki | mediawiki | up to 1.35.1 |
References
- github.com (Patch, Third Party Advisory)
- phabricator.wikimedia.org (Exploit, Third Party Advisory)