CVE-2020-35623 Auth bypass in n/a
Improper username validation in the CasAuth extension allows attackers to impersonate privileged users by manipulating special characters in usernames.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-35623?
CVE-2020-35623 is a high-severity authentication bypass vulnerability in Mediawiki Mediawiki, published on 21 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a similar username, as demonstrated by usernames that differ only in (1) bidirectional override symbols or (2) blank space.
Which versions are affected by CVE-2020-35623?
1 open source package ship an affected version, including mediawiki. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mediawiki Bitnami | All versions | 1.35.2 |
Products include Mediawiki Mediawiki.
How do I fix CVE-2020-35623?
Upgrade mediawiki to 1.35.2 or later.
Upgrade, and rotate credentials and sessions that may have been exposed. More about Authentication bypass.
Is CVE-2020-35623 being exploited?
There is no known exploitation of CVE-2020-35623 in the wild and no public exploit code.
Other vulnerabilities in Mediawiki Mediawiki
Sources
Also known as BIT-mediawiki-2020-35623, GHSA-3qff-43xr-cvvj.