CVE catalog

CVE-2020-35480

mediawiki affected and fixed versions

An issue was discovered in MediaWiki before 1.35.1. Missing users (accounts that don't exist) and hidden users (accounts that have been explicitly hidden due to being abusive, or similar) that the viewer cannot see are handled differently, exposing sensitive information about the hidden status to unprivileged viewers. This exists on various code paths.

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Published: Dec 18, 2020, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 1.49% · Oct 27, 2026

Projects and upstream resources

[mediawiki][Source-reported homepage]

Reported versions and fixes

Each observation applies to its named package, distribution, and release. Distribution backports can fix a vulnerability while retaining an older upstream version number.

Distribution / release	Package	Version	Status	Source
Debiantrixie-security	mediawiki	`1:1.43.9+dfsg-1~deb13u1`	Fixed	[CVE-2020-35480]
Debiantrixie	mediawiki	`1:1.35.1-1`	FixedDistribution-reported fixed boundary	[CVE-2020-35480]
Debiantrixie	mediawiki	`1:1.43.9+dfsg-1~deb13u1`	Fixed	[CVE-2020-35480]
Debiansid	mediawiki	`1:1.35.1-1`	FixedDistribution-reported fixed boundary	[CVE-2020-35480]
Debiansid	mediawiki	`1:1.43.11+dfsg-3`	Fixed	[CVE-2020-35480]
Debianforky	mediawiki	`1:1.35.1-1`	FixedDistribution-reported fixed boundary	[CVE-2020-35480]
Debianforky	mediawiki	`1:1.43.11+dfsg-1`	Fixed	[CVE-2020-35480]
Debianbookworm-security	mediawiki	`1:1.39.17-1+deb12u2`	Fixed	[CVE-2020-35480]
Debianbookworm	mediawiki	`1:1.35.1-1`	FixedDistribution-reported fixed boundary	[CVE-2020-35480]
Debianbookworm	mediawiki	`1:1.39.17-1+deb12u2`	Fixed	[CVE-2020-35480]

Provider details and historical evidence

Distribution / release	Package	Version	Status	Source
Debianbookworm	mediawiki	`1:1.35.1-1`	FixedDistribution-reported fixed boundary	[CVE-2020-35480]
Debianbookworm	mediawiki	`1:1.39.17-1+deb12u2`	Fixed	[CVE-2020-35480]
Debianbookworm-security	mediawiki	`1:1.39.17-1+deb12u2`	Fixed	[CVE-2020-35480]
Debianforky	mediawiki	`1:1.35.1-1`	FixedDistribution-reported fixed boundary	[CVE-2020-35480]
Debianforky	mediawiki	`1:1.43.11+dfsg-1`	Fixed	[CVE-2020-35480]
Debiansid	mediawiki	`1:1.35.1-1`	FixedDistribution-reported fixed boundary	[CVE-2020-35480]
Debiansid	mediawiki	`1:1.43.11+dfsg-3`	Fixed	[CVE-2020-35480]
Debiantrixie	mediawiki	`1:1.35.1-1`	FixedDistribution-reported fixed boundary	[CVE-2020-35480]
Debiantrixie	mediawiki	`1:1.43.9+dfsg-1~deb13u1`	Fixed	[CVE-2020-35480]
Debiantrixie-security	mediawiki	`1:1.43.9+dfsg-1~deb13u1`	Fixed	[CVE-2020-35480]

Original provider fields

{
  "package_releases": [
    {
      "name": "mediawiki",
      "status": "fixed",
      "release": "sid",
      "version": "1:1.43.11+dfsg-3"
    },
    {
      "name": "mediawiki",
      "status": "fixed",
      "release": "forky",
      "version": "1:1.43.11+dfsg-1"
    },
    {
      "name": "mediawiki",
      "status": "fixed",
      "release": "trixie",
      "version": "1:1.43.9+dfsg-1~deb13u1"
    },
    {
      "name": "mediawiki",
      "status": "fixed",
      "release": "trixie-security",
      "version": "1:1.43.9+dfsg-1~deb13u1"
    },
    {
      "name": "mediawiki",
      "status": "fixed",
      "release": "bookworm",
      "version": "1:1.39.17-1+deb12u2"
    },
    {
      "name": "mediawiki",
      "status": "fixed",
      "release": "bookworm-security",
      "version": "1:1.39.17-1+deb12u2"
    }
  ],
  "fixed_versions": [
    {
      "bug": null,
      "name": "mediawiki",
      "type": "source",
      "origin": null,
      "release": "sid",
      "urgency": "not yet assigned",
      "fixed_version": "1:1.35.1-1"
    },
    {
      "bug": null,
      "name": "mediawiki",
      "type": "source",
      "origin": null,
      "release": "forky",
      "urgency": "not yet assigned",
      "fixed_version": "1:1.35.1-1"
    },
    {
      "bug": null,
      "name": "mediawiki",
      "type": "source",
      "origin": null,
      "release": "trixie",
      "urgency": "not yet assigned",
      "fixed_version": "1:1.35.1-1"
    },
    {
      "bug": null,
      "name": "mediawiki",
      "type": "source",
      "origin": null,
      "release": "bookworm",
      "urgency": "not yet assigned",
      "fixed_version": "1:1.35.1-1"
    }
  ],
  "distribution_packages": []
}

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[mediawiki]Unknown
Details (4)
- 1:1.39.17-1+deb12u2 · all · bookworm
  Fixed · Fixed: 1:1.35.1-1
  dsa · mediawiki · debian · bookworm; dsa · mediawiki · debian · 12
- 1:1.39.17-1+deb12u2 · all · bookworm
  Fixed · Fixed: 1:1.35.1-1
  dsa · mediawiki · debian · bookworm; dsa · mediawiki · debian · 12
- 1:1.39.17-1+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:1.35.1-1
  dsa · mediawiki · debian · bookworm; dsa · mediawiki · debian · 12
- 1:1.39.17-1+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:1.35.1-1
  dsa · mediawiki · debian · bookworm; dsa · mediawiki · debian · 12
[mediawiki-classes]Unknown
Source package: [mediawiki]
Details (4)
- 1:1.39.17-1+deb12u2 · all · bookworm
  Fixed · Fixed: 1:1.35.1-1
  dsa · mediawiki · debian · bookworm; dsa · mediawiki · debian · 12
- 1:1.39.17-1+deb12u2 · all · bookworm
  Fixed · Fixed: 1:1.35.1-1
  dsa · mediawiki · debian · bookworm; dsa · mediawiki · debian · 12
- 1:1.39.17-1+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:1.35.1-1
  dsa · mediawiki · debian · bookworm; dsa · mediawiki · debian · 12
- 1:1.39.17-1+deb12u2 · all · bookworm-security
  Fixed · Fixed: 1:1.35.1-1
  dsa · mediawiki · debian · bookworm; dsa · mediawiki · debian · 12

[Debian 13 (Trixie)]

[mediawiki]Unknown
Details (4)
- 1:1.43.9+dfsg-1~deb13u1 · all · trixie
  Fixed · Fixed: 1:1.35.1-1
  dsa · mediawiki · debian · 13
- 1:1.43.9+dfsg-1~deb13u1 · all · trixie
  Fixed · Fixed: 1:1.35.1-1
  dsa · mediawiki · debian · 13
- 1:1.43.9+dfsg-1~deb13u1 · all · trixie-security
  Fixed · Fixed: 1:1.35.1-1
  dsa · mediawiki · debian · 13
- 1:1.43.9+dfsg-1~deb13u1 · all · trixie-security
  Fixed · Fixed: 1:1.35.1-1
  dsa · mediawiki · debian · 13
[mediawiki-classes]Unknown
Source package: [mediawiki]
Details (4)
- 1:1.43.9+dfsg-1~deb13u1 · all · trixie
  Fixed · Fixed: 1:1.35.1-1
  dsa · mediawiki · debian · 13
- 1:1.43.9+dfsg-1~deb13u1 · all · trixie
  Fixed · Fixed: 1:1.35.1-1
  dsa · mediawiki · debian · 13
- 1:1.43.9+dfsg-1~deb13u1 · all · trixie-security
  Fixed · Fixed: 1:1.35.1-1
  dsa · mediawiki · debian · 13
- 1:1.43.9+dfsg-1~deb13u1 · all · trixie-security
  Fixed · Fixed: 1:1.35.1-1
  dsa · mediawiki · debian · 13

Observed: Oct 23, 2026, 5:51:31 PM UTC

References

[Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]