← Back to CVEs

CVE-2020-35623

HIGH

7.5

Description

An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a similar username, as demonstrated by usernames that differ only in (1) bidirectional override symbols or (2) blank space.

CVE Details

CVSS v3.1 Score7.5

SeverityHIGH

CVSS VectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Attack VectorNETWORK

ComplexityLOW

Privileges RequiredNONE

User InteractionNONE

Published12/21/2020

Last Modified11/21/2024

Sourcenvd

Honeypot Sightings0

Affected Products

mediawiki:mediawiki

Weaknesses (CWE)

CWE-20CWE-706

References

https://github.com/CWRUChielLab/CASAuth/pull/11(cve@mitre.org)

https://phabricator.wikimedia.org/T263498(cve@mitre.org)

https://github.com/CWRUChielLab/CASAuth/pull/11(af854a3a-2127-422b-91ae-364da2661108)

https://phabricator.wikimedia.org/T263498(af854a3a-2127-422b-91ae-364da2661108)

IOC Correlations

No correlations recorded

This product uses data from the NVD API but is not endorsed or certified by the NVD.