medium6.5
CVE-2019-12470
Wikimedia MediaWik exposed suppressed log in RevisionDelete page
Impact
Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | mediawiki/core | >= 1.27.0, < 1.27.6 | 1.27.6 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mediawiki | Mediawiki | before 1.27.6 from 1.27.7 before 1.30.2 from 1.31.0 before 1.31.2 from 1.32.0 before 1.32.2 |
| Debian | Debian Linux | Version 9.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html
- https://phabricator.wikimedia.org/T222038
- https://seclists.org/bugtraq/2019/Jun/12
- https://www.debian.org/security/2019/dsa-4460
- https://github.com/advisories/GHSA-733q-m38x-q7cc
- https://nvd.nist.gov/vuln/detail/CVE-2019-12470
- https://github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2019-12470.yaml