PT-2020-5772 · Mediawiki+1 · Mediawiki+1

Published 2020-12-05 · Updated 2024-03-06 · CVE-2020-35480

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.35.1

Description: The issue is related to the incorrect handling of missing and hidden users in MediaWiki, which can expose sensitive information about the hidden status to unprivileged viewers. This can be exploited by a remote attacker to gain access to confidential data. The problem exists in various code paths and affects the handling of users that the viewer cannot see, including missing users and hidden users that have been explicitly hidden due to abusive behavior or similar reasons.

Recommendations: For MediaWiki versions prior to 1.35.1, update to version 1.35.1 or later to resolve the issue. As a temporary workaround, consider restricting access to sensitive information until the update can be applied.

Fix

Information Disclosure

Side Channel Attack

Weakness Enumeration

CWE-200

CWE-203

Related Identifiers

ALT-PU-2020-3554

ALT-PU-2020-3568

BDU:2021-01731

BIT-MEDIAWIKI-2020-35480

CVE-2020-35480

DLA-2504-1

DSA-4816-1

MGASA-2021-0086

Affected Products

Alt Linux

Mediawiki

References · 30

• https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December/000268.html · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2020-35480 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2021-0086 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-35480 · Security Note
• https://ubuntu.com/security/CVE-2020-35480 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-35480 · Security Note
• https://debian.org/security/2020/dsa-4816 · Vendor Advisory
• https://osv.dev/vulnerability/DLA-2504-1 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-35480 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2020-35480 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mediawiki-2020-35480 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STT5Z4A3BCXVH3WIPICWU2FP4IPIMUPC · Vendor Advisory
• https://advisories.mageia.org/MGASA-2021-0086.html · Security Note
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/STT5Z4A3BCXVH3WIPICWU2FP4IPIMUPC · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-35480 · Vendor Advisory