CVE-2020-15164
Critical
Description
in Scratch Login (MediaWiki extension) before version 1.1, any account can be logged into by using the same username with leading, trailing, or repeated underscore(s), since those are treated as whitespace and trimmed by MediaWiki. This affects all users on any wiki using this extension. Since version 1.1, comments by users whose usernames would be trimmed on MediaWiki are ignored when searching for the verification code.
SeverityCritical
CVSS10.0
Exploit probability—
ProductScratch-wiki Scratch Login
PublishedAug 28, 2020
First seenAug 28, 2020
Weakness typeCWE-287Improper authentication
How to fix
Update
- scratch-wiki scratch_login1.1 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| scratch-wiki scratch_login | v < 1.1 | 1.1 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.