Description
An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a similar username, as demonstrated by usernames that differ only in (1) bidirectional override symbols or (2) blank space.
Remediation
References
Related Vulnerabilities
TYPO3 Improper Authentication Vulnerability (CVE-2011-4628)
Magento Improper Authorization Vulnerability (CVE-2020-24402)
WordPress Plugin Contact Form 7 Zendesk Cross-Site Scripting (1.0.7)
WordPress Plugin Ultimate Addons for Elementor Security Bypass (1.20.0)
WordPress Plugin Estatik Real Estate Arbitrary File Upload (2.2.5)