PT-2020-12190 · Wikimedia+1 · Mediawiki+2

Marcoaurelio · Published 2020-03-12 · Updated 2024-03-06 · CVE-2020-10534

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.34.0 GlobalBlocking extension before 2020-03-10

Description An issue related to IP range evaluation resulted in blocked users re-gaining escalated privileges. This is related to the case in which an IP address is contained in two ranges, one of which is locally disabled.

Recommendations For MediaWiki versions prior to 1.34.0, update to a version that includes the fix for the IP range evaluation issue in the GlobalBlocking extension. For the GlobalBlocking extension before 2020-03-10, ensure that the IP range evaluation is properly handled to prevent blocked users from re-gaining escalated privileges. As a temporary workaround, consider disabling the locally disabled IP range to minimize the risk of exploitation.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

ALT-PU-2020-1642

ALT-PU-2020-2249

BIT-MEDIAWIKI-2020-10534

CVE-2020-10534

Affected Products

Alt Linux

Globalblocking Extension

Mediawiki

References · 6

• https://phabricator.wikimedia.org/T229731 · Vendor Advisory
• https://gerrit.wikimedia.org/r/#/q/I9cc5fb2c08c78bbd797a5fc6d89f4577c8cc118b · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-10534 · Security Note
• https://osv.dev/vulnerability/CVE-2020-10534 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mediawiki-2020-10534 · Vendor Advisory
• https://t.me/cvenotify/1625 · Telegram Post