MediaWiki Incorrect Access Control vulnerability in mediawiki/core
Summary
CVE-2019-12469: MediaWiki Incorrect Access Control vulnerability. Affects mediawiki/core across 4 version ranges.
>= 1.27.0, < 1.27.6
>= 1.30.0, < 1.30.2
>= 1.31.0, < 1.31.2
>= 1.32.0, < 1.32.2
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- mediawiki · Debian:11
The same CVE-2019-12469 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MediaWiki is a free and open-source wiki software that powers numerous websites, including Wikipedia. It provides a platform for collaborative editing and content management. The mediawiki/core package is the core component of MediaWiki, responsible for its fundamental functionality. Unfortunately, this package is susceptible to an Incorrect Access Control vulnerability.
Vulnerability Detail
The Incorrect Access Control vulnerability in MediaWiki through 1.32.1 allows suppressed usernames or logins in the Special:EditTags feature to be exposed. This vulnerability can be exploited by an attacker to gain unauthorized access to sensitive information. The issue has been fixed in versions 1.32.2, 1.31.2, 1.30.2, and 1.27.6 of the mediawiki/core package.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.27.0, < 1.27.61.27.6composer require mediawiki/core:1.27.6 -
>= 1.30.0, < 1.30.21.30.2composer require mediawiki/core:1.30.2 -
>= 1.31.0, < 1.31.21.31.2composer require mediawiki/core:1.31.2 -
>= 1.32.0, < 1.32.21.32.2composer require mediawiki/core:1.32.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is crucial to update the mediawiki/core package to the fixed versions as soon as possible.
Conclusion
The MediaWiki Incorrect Access Control vulnerability in the mediawiki/core package exposes suppressed usernames or logins in the Special:EditTags feature, potentially allowing unauthorized access to sensitive information. It is crucial to update the package to the fixed versions (1.32.2, 1.31.2, 1.30.2, or 1.27.6) to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mediawiki/core →
FAQ
MediaWiki is a free and open-source wiki software that powers numerous websites, including Wikipedia. It provides a platform for collaborative editing and content management.
The mediawiki/core package is the core component of MediaWiki, responsible for its fundamental functionality.
An Incorrect Access Control vulnerability allows unauthorized access to certain features or information. In this case, suppressed usernames or logins in the Special:EditTags feature of MediaWiki are exposed.
This vulnerability can be exploited by an attacker to gain unauthorized access to sensitive information.
To fix this vulnerability, update the mediawiki/core package to version 1.32.2, 1.31.2, 1.30.2, or 1.27.6.
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki/core.
