What is CVE-2020-15164?

CVE-2020-15164 is a critical-severity vulnerability in Internationalscratchwiki Mediawiki-Scratch-Login, classified under Improper Authentication. CVSS score: 10.0/10. Published 2020-08-28.

How severe is CVE-2020-15164?

Critical severity. CVSS v3 base score is 10.0 out of 10.

Auth bypass in Internationalscratchwiki Mediawiki-Scratch-Login

CVE-2020-15164

in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing, or repeated underscore(s), since those are treated as whitespace and trimmed by MediaWiki. This affects all users on any wiki using this extension. Since version 1.1, comments by users whose usernames would be trimmed on MediaWiki are ignored when searching for the verification code.

Vulnerability class: Broken Authentication

EPSS: 0.012 (64.3th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 10.0 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N.

Affected products

Internationalscratchwiki Mediawiki-scratch-login — versions < 1.1
Scratch-wiki Scratch_login

Weakness classification (CWE)

References

security-advisories@github.com (x_refsource_CONFIRM, Third Party Advisory)
security-advisories@github.com (Patch, Third Party Advisory, x_refsource_MISC)

Frequently asked questions

What is CVE-2020-15164?: CVE-2020-15164 is a critical-severity vulnerability in Internationalscratchwiki Mediawiki-Scratch-Login, classified under Improper Authentication. CVSS score: 10.0/10. Published 2020-08-28.
How severe is CVE-2020-15164?: Critical severity. CVSS v3 base score is 10.0 out of 10.