CVE-2019-12469: Medium severity mediawiki vulnerability
Published Jun 6, 2019
·Updated
Exposed suppressed username or log in Special:EditTags
Other sources
MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
Affected Software
11 affected componentsFixes available
composer/mediawiki/core>=1.27.0, <1.27.6, >=1.30.0, <1.30.2, >=1.31.0, <1.31.2, >=1.32.0, <1.32.2
debian/mediawiki
1:1.31.16-1+deb10u21:1.31.16-1+deb10u61:1.35.11-1~deb11u11:1.35.13-1~deb11u11:1.39.4-1~deb12u11:1.39.5-1~deb12u11:1.39.5-1
composer/mediawiki/core>=1.32.0<1.32.2
1.32.2
composer/mediawiki/core>=1.31.0<1.31.2
1.31.2
composer/mediawiki/core>=1.30.0<1.30.2
1.30.2
composer/mediawiki/core>=1.27.0<1.27.6
1.27.6
MediaWiki MediaWiki<1.27.6
MediaWiki MediaWiki>=1.27.7<1.30.2
MediaWiki MediaWiki>=1.31.0<1.31.2
MediaWiki MediaWiki>=1.32.0<1.32.2
Debian Debian Linux=9.0
Event History
Jun 6, 2019
Advisory Published
09:28 PM
Jul 10, 2019
CVE Published
via MITRE·04:01 PM
Data Sourced
via MITRE·04:01 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-12469?
The severity of CVE-2019-12469 is assessed as moderate due to incorrect access control exposing suppressed usernames.
2
How do I fix CVE-2019-12469?
To fix CVE-2019-12469, upgrade to MediaWiki version 1.32.2, 1.31.2, 1.30.2, or 1.27.6.
3
What versions are affected by CVE-2019-12469?
CVE-2019-12469 affects MediaWiki versions below 1.32.2, 1.31.2, 1.30.2, and 1.27.6.
4
What systems are vulnerable to CVE-2019-12469?
Systems running MediaWiki versions between 1.27.0 and 1.32.1 are vulnerable to CVE-2019-12469.
5
Is CVE-2019-12469 a critical vulnerability?
CVE-2019-12469 is not considered critical but poses a risk due to exposure of sensitive username information.