| Package | Affected versions | Patched versions |
|---|---|---|
| mediawiki | ≤ 1.35.1 |
An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a similar username, as demonstrated by usernames that differ only in (1) bidirectional override symbols or (2) blank space.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free