Description
An issue was discovered in the CasAuth extension for MediaWiki through 1.35.1. Due to improper username validation, it allowed user impersonation with trivial manipulations of certain characters within a given username. An ordinary user may be able to login as a "bureaucrat user" who has a similar username, as demonstrated by usernames that differ only in (1) bidirectional override symbols or (2) blank space.
Remediation
References
Related Vulnerabilities
Apache Tomcat Other Vulnerability (CVE-2010-3718)
SugarCRM Improper Input Validation Vulnerability (CVE-2011-0745)
Jboss EAP Permission Issues Vulnerability (CVE-2016-7066)
WordPress Plugin Opal Estate Cross-Site Request Forgery (1.6.11)
WordPress Plugin Google Sitemap by BestWebSoft Cross-Site Scripting (2.9.1)