Get a demo
100% Signal 0% Noise Invicti Logo - The Largest Dynamic Application Security Solutions Provider In The World Get a demo
MediaWiki Insufficiently Protected Credentials Vulnerability - CVE-2020-35623 - Vulnerability Database
MediaWiki

MediaWiki Insufficiently Protected Credentials Vulnerability - CVE-2020-35623

High
Reference: CVE-2020-35623
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2020-35623
Title: MediaWiki Insufficiently Protected Credentials Vulnerability
Overview:

An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a quotbureaucrat userquot who has a similar username as demonstrated by usernames that differ only in (1) bidirectional override symbols or (2) blank space.