Critical Access Control Vulnerability in MediaWiki: Potential Account Takeover Risk
Summary
CVE-2019-12468: An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Affects mediawiki across 2 version ranges.
< 1:1.31.2-1
>= 758cd9d2371d529450448cdf7eb2f1f6e099cfee, <= 66c3c50df50e3055f69932a90b7b465f43933d18
Fixed in 1:1.31.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MediaWiki is a widely-used open-source wiki software platform that allows users to create and manage collaborative content. It is known for its flexibility, extensibility, and support for various media types. However, certain versions of MediaWiki have been found to contain a critical vulnerability that compromises user account security.
Vulnerability Detail
An Incorrect Access Control vulnerability exists in Wikimedia MediaWiki versions 1.27.0 through 1.32.1. This flaw allows attackers to bypass re-authentication by directly POSTing to the Special:ChangeEmail endpoint. As a result, unauthorized users could potentially take over accounts, leading to unauthorized access to sensitive information and functionalities.
How To Fix
Minimum fixed version
1:1.31.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mediawikiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can disable the Special:ChangeEmail functionality until the upgrade is completed. This can be done by modifying the LocalSettings.php file: $wgEnableUserEmail = false;
Conclusion
The Incorrect Access Control vulnerability in MediaWiki poses a significant risk to user accounts, allowing potential attackers to bypass security measures. It is crucial for users to upgrade to the latest version to mitigate this risk and ensure the security of their applications.
See every vulnerability recorded for mediawiki →
FAQ
The CVSS score of this vulnerability is 9.8, indicating a critical level of severity.
MediaWiki versions 1.27.0 through 1.32.1 are affected by this vulnerability.
If exploited, this vulnerability could lead to unauthorized account access and potential data breaches.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Vulert is a tool that monitors and alerts in real-time for open-source vulnerabilities in software using just a manifest file like package-lock.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki.
