MediaWiki Incorrect Access Control vulnerability in mediawiki/core
Summary
CVE-2019-12472: MediaWiki Incorrect Access Control vulnerability. Affects mediawiki/core across 4 version ranges.
>= 1.18.0, < 1.27.6
>= 1.30.0, < 1.30.2
>= 1.31.0, < 1.31.2
>= 1.32.0, < 1.32.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- mediawiki · Debian:11
The same CVE-2019-12472 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MediaWiki is a free and open-source wiki software used to power numerous websites, including Wikipedia. It provides a platform for collaborative editing and content management. The vulnerability affects versions 1.18.0 through 1.32.1 of the MediaWiki core package. This vulnerability allows bypassing the limits on IP range blocks ($wgBlockCIDRLimit) by using the API.
Vulnerability Detail
The Incorrect Access Control vulnerability in MediaWiki allows an attacker to bypass IP range blocks by exploiting a flaw in the API. This can lead to unauthorized access and potential abuse of the system. The vulnerability was assigned a CVSS score of 7.5, indicating a high severity level. It was fixed in versions 1.32.2, 1.31.2, 1.30.2, and 1.27.6 of the MediaWiki core package.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.18.0, < 1.27.61.27.6composer require mediawiki/core:1.27.6 -
>= 1.30.0, < 1.30.21.30.2composer require mediawiki/core:1.30.2 -
>= 1.31.0, < 1.31.21.31.2composer require mediawiki/core:1.31.2 -
>= 1.32.0, < 1.32.21.32.2composer require mediawiki/core:1.32.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround mentioned for this vulnerability.
Conclusion
The MediaWiki Incorrect Access Control vulnerability in the mediawiki/core package allows bypassing IP range blocks, potentially leading to unauthorized access and abuse of the system. It is recommended to update the package to one of the fixed versions (1.32.2, 1.31.2, 1.30.2, or 1.27.6) to mitigate the vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mediawiki/core →
FAQ
MediaWiki is a free and open-source wiki software used for collaborative editing and content management.
The vulnerability allows bypassing IP range blocks, potentially leading to unauthorized access and abuse of the system.
Versions 1.18.0 through 1.32.1 of the MediaWiki core package are affected.
To fix the vulnerability, update the MediaWiki core package to one of the fixed versions (1.32.2, 1.31.2, 1.30.2, or 1.27.6).
No specific workaround has been mentioned for this vulnerability.
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki/core.
