CVE-2019-12467: Medium severity mediawiki vulnerability
MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3). A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability to block them. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
Other sources
Need to make a limit of count of attempts to change email address
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12467?
CVE-2019-12467 has a moderate severity due to the lack of rate limiting on the Special:ChangeEmail function.
How do I fix CVE-2019-12467?
To fix CVE-2019-12467, upgrade to MediaWiki versions 1.32.2, 1.31.2, 1.30.2, or 1.27.6.
Which versions of MediaWiki are affected by CVE-2019-12467?
MediaWiki versions from 1.27.0 up to 1.32.1 are affected by CVE-2019-12467.
What are the consequences of CVE-2019-12467?
The consequences of CVE-2019-12467 include potential spam from unauthorized users exploiting the email change feature.
Is there a specific action required to mitigate CVE-2019-12467?
Yes, implementing a limit on the number of attempts to change an email address can help mitigate CVE-2019-12467.