Log in Start free

Vulnerability · Published Dec 18, 2020 · Assigned by mitre

CVE-2020-35477

Medium 5.3

In plain English

A medium-severity security flaw in the mediawiki package (Debian). There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 78% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.3Medium
Exploit odds (30 days)1.7%top 22.5% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known

Official description

MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpage to Special:MyLanguage/Main Page, visits a log entry on Special:Log, and toggles the "Change visibility of selected log entries" checkbox (or a tags checkbox) next to it, there is a redirection to the main page's action=historysubmit (instead of the desired behavior in which a revision-deletion form appears).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12mediawiki1:1.35.1-1DEBIAN-CVE-2020-35477
Debian:13mediawiki1:1.35.1-1DEBIAN-CVE-2020-35477
Debian:14mediawiki1:1.35.1-1DEBIAN-CVE-2020-35477
Ubuntu:25.10mediawikino fix listedUBUNTU-CVE-2020-35477
Ubuntu:26.04:LTSmediawikino fix listedUBUNTU-CVE-2020-35477
Ubuntu:26.10mediawikino fix listedUBUNTU-CVE-2020-35477

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References