Unrated severityNVD Advisory· Published Dec 21, 2020· Updated Aug 4, 2024
CVE-2020-35623
CVE-2020-35623
Description
An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a similar username, as demonstrated by usernames that differ only in (1) bidirectional override symbols or (2) blank space.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
3- MediaWiki/CasAuthdescription
Patches
Vulnerability mechanics
References
2- github.com/CWRUChielLab/CASAuth/pull/11mitrex_refsource_MISC
- phabricator.wikimedia.org/T263498mitrex_refsource_MISC
News mentions
0No linked articles in our index yet.