CVE-2020-25813: Medium severity mediawiki vulnerability

Q: What is the severity of CVE-2020-25813?

CVE-2020-25813 is a medium severity vulnerability that allows exposure of hidden users in MediaWiki.

Q: How do I fix CVE-2020-25813?

To fix CVE-2020-25813, upgrade to MediaWiki versions 1.31.10, 1.34.4, or later.

Q: Which MediaWiki versions are affected by CVE-2020-25813?

CVE-2020-25813 affects MediaWiki versions before 1.31.10 and versions between 1.32.0 and 1.34.3.

Q: What is the impact of CVE-2020-25813 on MediaWiki installations?

CVE-2020-25813 allows unauthorized disclosure of hidden user identities, potentially compromising user privacy.

Q: Is CVE-2020-25813 exploitable remotely?

Yes, CVE-2020-25813 can be exploited remotely by anyone with access to the affected MediaWiki installation.

Published Sep 21, 2020

Updated

In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users.

Other sources

In MediaWiki before 1.31.9 and 1.32.x through 1.34.x before 1.34.3, Special:UserRights exposes the existence of hidden users.

— GitHub

Affected Software

7 affected componentsFixes available

composer/mediawiki/core>=1.31.0, <1.31.9, >=1.34.0, <1.34.3

debian/mediawiki

1:1.31.16-1+deb10u21:1.31.16-1+deb10u61:1.35.11-1~deb11u11:1.35.13-1~deb11u11:1.39.4-1~deb12u11:1.39.5-1~deb12u11:1.39.5-1

composer/mediawiki/core>=1.32.0<1.34.3

1.34.3

composer/mediawiki/core>=1.31.0<1.31.9

1.31.9

MediaWiki<1.31.10

MediaWiki>=1.32.0<1.34.4

fedoraproject fedora=33

Event History

Sep 21, 2020

Advisory Published

04:46 PM

Sep 27, 2020

CVE Published

via MITRE·08:44 PM

Data Sourced

via MITRE·08:44 PM

Description

Frequently Asked Questions

What is the severity of CVE-2020-25813?

CVE-2020-25813 is a medium severity vulnerability that allows exposure of hidden users in MediaWiki.

How do I fix CVE-2020-25813?