logo

Database

User enumeration In mediawiki

Description

MediaWiki Special:UserRights exposes the existence of hidden users In MediaWiki before 1.31.9 and 1.32.x through 1.34.x before 1.34.3, Special:UserRights exposes the existence of hidden users.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Package
Affected version
Patched versions

Aliases

1. CVE-2020-258132. NVD-2020-258133. OSV-DEBIAN-2020-258134. OSV-2020-258135. GCVE-2020-258136. SECURITY-TRACKER-CVE-2020-25813

References

1. https://github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2020-25813.yaml2. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU63. https://lists.fedoraproject.org/archives/list/[email protected]/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU64. https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html5. https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html6. https://meta.wikimedia.org/wiki/Special:UserRights7. https://phabricator.wikimedia.org/T232568

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.