CVE-2020-35477: 
NixOS vulnerability analysis and mitigation

CVE-2020-35477 affects MediaWiki versions before 1.35.1, where the software blocks legitimate attempts to hide log entries in specific situations. The vulnerability occurs when MediaWiki:Mainpage is set to Special:MyLanguage/Main Page and a user attempts to toggle the 'Change visibility of selected log entries' checkbox on Special:Log, resulting in an unintended redirection to the main page's action=historysubmit instead of displaying the revision-deletion form (MediaWiki Announce).

The vulnerability is classified with a CVSS v3.1 Base Score of 5.3 (MEDIUM) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. This indicates that the vulnerability can be exploited over the network, requires low attack complexity, needs no privileges, requires no user interaction, has unchanged scope, and can only impact integrity with low severity (NVD).

The vulnerability affects the log entry visibility control functionality, preventing administrators from properly managing log entry visibility when certain configuration conditions are met. This could impact the wiki's ability to properly maintain privacy and content control measures (MediaWiki Announce).

The vulnerability can be triggered when specific conditions are met: the MediaWiki:Mainpage must be set to Special:MyLanguage/Main Page, and the user must attempt to modify log entry visibility through Special:Log. No known active exploits in the wild have been reported (Debian LTS).

The vulnerability has been fixed in MediaWiki version 1.35.1. Users are advised to upgrade to this version or apply appropriate security patches. Various Linux distributions have also released security updates, including Debian with version 1:1.31.12-1~deb10u1 for Buster and 1:1.27.7-1~deb9u7 for Stretch (Debian Security, Debian LTS).