CVE Vulnerabilities

CVE-2020-35477

Always-Incorrect Control Flow Implementation

Published: Dec 18, 2020 | Modified: Nov 07, 2023
CVSS 3.x
5.3
MEDIUM
Source:
NVD
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.x
5 MEDIUM
AV:N/AC:L/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu

MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpage to Special:MyLanguage/Main Page, visits a log entry on Special:Log, and toggles the Change visibility of selected log entries checkbox (or a tags checkbox) next to it, there is a redirection to the main pages action=historysubmit (instead of the desired behavior in which a revision-deletion form appears).

Weakness

The code contains a control flow path that does not reflect the algorithm that the path is intended to implement, leading to incorrect behavior any time this path is navigated.

Affected Software

Name Vendor Start Version End Version
Mediawiki Mediawiki * 1.35.1 (excluding)

References