CVE-2019-12466: CSRF
Published Jul 10, 2019
·Updated
Use token when logging out
Other sources
Wikimedia MediaWiki through 1.32.1 allows CSRF in logout feature.
— GitHub
Affected Software
8 affected componentsFixes available
composer/mediawiki/core>=1.27.0, <1.27.6, >=1.30.0, <1.30.2, >=1.31.0, <1.31.2, >=1.32.0, <1.32.2, >=1.32.99, <1.33.0
debian/mediawiki
1:1.31.16-1+deb10u21:1.31.16-1+deb10u61:1.35.11-1~deb11u11:1.35.13-1~deb11u11:1.39.4-1~deb12u11:1.39.5-1~deb12u11:1.39.5-1
composer/mediawiki/core>=1.32.0<1.32.2
1.32.2
composer/mediawiki/core>=1.31.0<1.31.2
1.31.2
composer/mediawiki/core>=1.30.0<1.30.2
1.30.2
composer/mediawiki/core>=1.27.0<1.27.6
1.27.6
MediaWiki MediaWiki<=1.32.1
Debian Debian Linux=9.0
Remediation
Patch Available
Event History
Jul 10, 2019
CVE Published
via MITRE·03:31 PM
Data Sourced
via MITRE·03:31 PM
Description
May 24, 2022
Advisory Published
via GitHub·04:49 PM
Frequently Asked Questions
1
What is the severity of CVE-2019-12466?
CVE-2019-12466 is considered a medium severity vulnerability due to its potential for CSRF attacks.
2
How do I fix CVE-2019-12466?
To fix CVE-2019-12466, upgrade to MediaWiki versions 1.32.2, 1.31.2, or 1.27.6.
3
Which versions of MediaWiki are affected by CVE-2019-12466?
CVE-2019-12466 affects MediaWiki versions from 1.27.0 up to and including 1.32.1.
4
What type of vulnerability is CVE-2019-12466?
CVE-2019-12466 is a cross-site request forgery (CSRF) vulnerability related to the logout feature.
5
What should I do if I cannot upgrade to a fixed version for CVE-2019-12466?
If upgrading is not possible, consider implementing additional CSRF protections or monitoring for suspicious logout activities.