CVE-2020-35480

An issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don't exist) and hidden users (accounts that have been explicitly hidden due to being abusive, or similar) that the viewer cannot see are handled differently, exposing sensitive information about the hidden status to unprivileged viewers. This exists on various code paths.

• CWE-203

• https://lists.debian.org/debian-lts-announce/2020/12/msg00034.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STT5Z4A3BCXVH3WIPICWU2FP4IPIMUPC/
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December/000268.htmlMailing List, Release Notes, Vendor Advisory
• https://phabricator.wikimedia.org/T120883Permissions Required
• https://www.debian.org/security/2020/dsa-4816Mailing List, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2020/12/msg00034.htmlMailing List, Third Party Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/STT5Z4A3BCXVH3WIPICWU2FP4IPIMUPC/
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2020-December/000268.htmlMailing List, Release Notes, Vendor Advisory
• https://phabricator.wikimedia.org/T120883Permissions Required
• https://www.debian.org/security/2020/dsa-4816Mailing List, Third Party Advisory

Published

Dec 18, 2020

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2020-35475In MediaWiki before 1.35.1, the messages userrights-expiry-c…7.5
• CVE-2020-35476A remote code execution vulnerability occurs in OpenTSDB thr…9.8
• CVE-2020-35477MediaWiki before 1.35.1 blocks legitimate attempts to hide l…5.3
• CVE-2020-35478MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php…6.1
• CVE-2020-35479MediaWiki before 1.35.1 allows XSS via BlockLogFormatter.php…6.1
• CVE-2020-3548A vulnerability in the Transport Layer Security (TLS) protoc…7.5
• CVE-2020-35481SolarWinds Serv-U before 15.2.2 allows Unauthenticated Macro…9.8
• CVE-2020-35482SolarWinds Serv-U before 15.2.2 allows authenticated reflect…5.4
• CVE-2020-35483AnyDesk before 6.1.0 on Windows, when run in portable mode o…7.8
• CVE-2020-35488The fileop module of the NXLog service in NXLog Community Ed…7.5
• CVE-2020-35489The contact-form-7 (aka Contact Form 7) plugin before 5.3.2 …10
• CVE-2020-3549A vulnerability in the sftunnel functionality of Cisco Firep…8.1