CVE-2020-35480

State: Published
Severity: Not scored
Published: Dec 18, 2020
Updated: Aug 4, 2024
Reserved: Dec 16, 2020

Description

An issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don't exist) and hidden users (accounts that have been explicitly hidden due to being abusive, or similar) that the viewer cannot see are handled differently, exposing sensitive information about the hidden status to unprivileged viewers. This exists on various code paths.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

https://phabricator.wikimedia.org/T120883
https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December/000268.html
DSA-4816vendor-advisory
[debian-lts-announce] 20201223 [SECURITY] [DLA 2504-1] mediawiki security updatemailing-list
FEDORA-2020-0be2d40e13vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.