CVE-2019-12470: Medium severity mediawiki vulnerability
Published Jun 6, 2019
·Updated
Exposed suppressed log in RevisionDelete page
Other sources
Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
Affected Software
11 affected componentsFixes available
composer/mediawiki/core>=1.27.0, <1.27.6, >=1.30.0, <1.30.2, >=1.31.0, <1.31.2, >=1.32.0, <1.32.2
debian/mediawiki
1:1.31.16-1+deb10u21:1.31.16-1+deb10u61:1.35.11-1~deb11u11:1.35.13-1~deb11u11:1.39.4-1~deb12u11:1.39.5-1~deb12u11:1.39.5-1
composer/mediawiki/core>=1.32.0<1.32.2
1.32.2
composer/mediawiki/core>=1.31.0<1.31.2
1.31.2
composer/mediawiki/core>=1.30.0<1.30.2
1.30.2
composer/mediawiki/core>=1.27.0<1.27.6
1.27.6
MediaWiki MediaWiki<1.27.6
MediaWiki MediaWiki>=1.27.7<1.30.2
MediaWiki MediaWiki>=1.31.0<1.31.2
MediaWiki MediaWiki>=1.32.0<1.32.2
Debian Debian Linux=9.0
Event History
Jun 6, 2019
Advisory Published
09:28 PM
Jul 10, 2019
CVE Published
via MITRE·04:04 PM
Data Sourced
via MITRE·04:04 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2019-12470?
CVE-2019-12470 has been classified as a vulnerability that involves incorrect access control leading to the exposure of suppressed logs.
2
How do I fix CVE-2019-12470?
To address CVE-2019-12470, upgrade to MediaWiki versions 1.32.2, 1.31.2, 1.30.2, or 1.27.6.
3
Which versions of MediaWiki are affected by CVE-2019-12470?
CVE-2019-12470 affects MediaWiki versions from 1.27.0 up to (but not including) 1.32.2.
4
Is there a workaround for CVE-2019-12470?
There is no official workaround recommended for CVE-2019-12470; upgrading to the fixed versions is advised.
5
What component of MediaWiki is affected by CVE-2019-12470?
CVE-2019-12470 specifically affects the RevisionDelete page in the MediaWiki application.