Access Control Bypass in MediaWiki: CVE-2019-12472
Summary
CVE-2019-12472: An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. Affects mediawiki across 2 version ranges.
< 1:1.31.2-1
>= 6a5b1dec913d4566acd6b0e31fbde212deccf001, < b1558252c5478239b6ecc6d1950f07f938b12604
Fixed in 1:1.31.2-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MediaWiki is a free and open-source wiki software platform used to create and manage collaborative websites. It is known for its scalability and flexibility, allowing users to edit and manage content easily. However, certain versions of MediaWiki, specifically from 1.18.0 to 1.32.1, are vulnerable to an Incorrect Access Control issue that can be exploited through the API, potentially compromising the integrity of IP range blocks.
Vulnerability Detail
CVE-2019-12472 is an Incorrect Access Control vulnerability found in MediaWiki versions 1.18.0 through 1.32.1. The flaw allows attackers to bypass the limits on IP range blocks, specifically the $wgBlockCIDRLimit setting, using the API. This could lead to unauthorized access and manipulation of content by allowing blocked users to circumvent restrictions. The vulnerability arises from insufficient validation of API requests, which can be exploited to gain elevated privileges.
How To Fix
Minimum fixed version
1:1.31.2-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mediawikiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can limit API access to trusted users only and monitor API usage closely until you can apply the patch. Additionally, consider implementing stricter IP blocking rules at the server level to mitigate the risk of unauthorized access.
Conclusion
CVE-2019-12472 is a significant vulnerability in MediaWiki that can lead to unauthorized access through API exploitation. It is crucial for users of affected versions to upgrade to the patched versions to ensure the security of their installations. Temporary workarounds can help mitigate risks until a full upgrade is possible.
See every vulnerability recorded for mediawiki →
FAQ
CVE-2019-12472 is a vulnerability in MediaWiki that allows attackers to bypass IP range blocks through the API.
MediaWiki versions 1.18.0 through 1.32.1 are affected by this vulnerability.
You can check your MediaWiki version and compare it against the affected versions. Additionally, you can use tools like Vulert to monitor for vulnerabilities.
The CVSS score of CVE-2019-12472 is 7.5, indicating a high severity level.
If you cannot upgrade immediately, implement stricter access controls and monitor API usage to mitigate potential exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki.
