// For flags

CVE-2020-35623

 

Severity Score

7.5
*CVSS v3.1

Exploit Likelihood

< 1%
*EPSS

Affected Versions

1
*CPE

Public Exploits

1
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a similar username, as demonstrated by usernames that differ only in (1) bidirectional override symbols or (2) blank space.

Se detectó un problema en la extensión CasAuth para MediaWiki versiones hasta 1.35.1.&#xa0;Debido a una comprobación inapropiada del nombre de usuario, permitió la suplantación del usuario con manipulaciones triviales de determinados caracteres dentro de un nombre de usuario determinado.&#xa0;Un usuario común es capaz de iniciar sesión como un "bureaucrat user" que presenta un nombre de usuario similar, como es demostrado por los nombres de usuario que solo difieren en (1) símbolos de anulación bidireccionales o (2) espacios en blanco

*Credits: N/A
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
High
Availability
None
Attack Vector
Network
Attack Complexity
Low
Authentication
None
Confidentiality
None
Integrity
Partial
Availability
None
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2020-12-21 CVE Reserved
  • 2020-12-21 CVE Published
  • 2024-08-04 CVE Updated
  • 2024-08-04 First Exploit
  • 2025-03-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-20: Improper Input Validation
  • CWE-706: Use of Incorrectly-Resolved Name or Reference
CAPEC
References (2)
URL Tag Source
URL Date SRC
Affected Vendors, Products, and Versions (1)