What’s Vulnerable › Vulnerabilities
CVE-2020-25813
- Severity: medium (CVSS 5.3 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 1.3% probability of exploitation in the next 30 days
- Public exploit or detection template: none known
- Published: 2020-09-27 · updated 2026-06-17
Description
In MediaWiki before 1.31.10 and 1.32.x through 1.34.x before 1.34.4, Special:UserRights exposes the existence of hidden users.
Affected products
- Fedoraproject Fedora: 33
- Wikimedia Foundation MediaWiki: before 1.31.10; from 1.32.0 before 1.34.4 — fixed in 1.31.10, 1.34.4
How to fix
Upgrade to a fixed version: Wikimedia Foundation MediaWiki 1.31.10, 1.34.4. Check the vendor advisory for mitigations.
References
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
- https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html
- https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html
- https://meta.wikimedia.org/wiki/Special:UserRights
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/RTTPZ7XMDS66I442OLLHXBDNP2LCBJU6/
- https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048480.html
- https://lists.wikimedia.org/pipermail/mediawiki-l/2020-September/048488.html
- https://meta.wikimedia.org/wiki/Special:UserRights
Get alerted when CVE-2020-25813 or the next vulnerability affects your stack