CVE-2019-12468: Critical severity mediawiki vulnerability
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover.
Other sources
Direct POST to Special:ChangeEmail will bypass reauth check
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12468?
CVE-2019-12468 is classified as an Incorrect Access Control vulnerability that could potentially lead to account takeover.
How do I fix CVE-2019-12468?
To fix CVE-2019-12468, upgrade your Wikimedia MediaWiki installation to version 1.32.2 or apply relevant patches available for versions 1.27.6, 1.30.2, or 1.31.2.
Which versions of MediaWiki are affected by CVE-2019-12468?
CVE-2019-12468 affects MediaWiki versions 1.27.0 through 1.32.1, specifically 1.27.0 to 1.27.6, 1.30.0 to 1.30.2, 1.31.0 to 1.31.2, and 1.32.0 to 1.32.2.
What are the consequences of CVE-2019-12468?
The consequences of CVE-2019-12468 include the potential for unauthorized users to change account email addresses without re-authentication, leading to account takeover.
Is there a workaround for CVE-2019-12468?
There are no documented workarounds for CVE-2019-12468; upgrading to a secure version is the recommended mitigation.