Related Vulnerabilities: CVE-2020-35477  

MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpage to Special:MyLanguage/Main Page, visits a log entry on Special:Log, and toggles the "Change visibility of selected log entries" checkbox (or a tags checkbox) next to it, there is a redirection to the main page's action=historysubmit (instead of the desired behavior in which a revision-deletion form appears).

Severity Low

Remote Yes

Type Information disclosure

Description

MediaWiki before 1.35.1 blocks legitimate attempts to hide log entries in some situations. If one sets MediaWiki:Mainpage to Special:MyLanguage/Main Page, visits a log entry on Special:Log, and toggles the "Change visibility of selected log entries" checkbox (or a tags checkbox) next to it, there is a redirection to the main page's action=historysubmit (instead of the desired behavior in which a revision-deletion form appears).

AVG-1371 mediawiki 1.35.0-1 1.35.1-1 Medium Fixed FS#69132

https://phabricator.wikimedia.org/T205908
https://github.com/wikimedia/mediawiki/commit/ac7aa53532bab782c7453e302d20e8a0712c8395