Auth bypass in MediaWiki
CVE-2020-25869
An information leak was discovered in MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4. Handling of actor ID does not necessarily use the correct database or correct wiki.
Vulnerability class: Broken Access Control
EPSS: 0.014 (69.8th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.5 (High). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N.
Affected products
- Mediawiki
- Fedoraproject Fedora — versions 33
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (Permissions Required, x_refsource_MISC, Vendor Advisory)
- cve@mitre.org (x_refsource_CONFIRM, Mailing List, Vendor Advisory)
- cve@mitre.org (Mailing List, x_refsource_MISC, Vendor Advisory)
- cve@mitre.org (x_refsource_FEDORA, vendor-advisory)
Frequently asked questions
- What is CVE-2020-25869?
- CVE-2020-25869 is a high-severity vulnerability in MediaWiki, classified under Incorrect Authorization. CVSS score: 7.5/10. Published 2020-09-27.
- How severe is CVE-2020-25869?
- High severity. CVSS v3 base score is 7.5 out of 10.