CVE-2019-12471: XSS
Loading JS from user space where the username is not a registered account is dangerous and should be banned
Other sources
Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on users loading that script. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-12471?
CVE-2019-12471 is classified as a medium severity vulnerability due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2019-12471?
To fix CVE-2019-12471, upgrade to MediaWiki versions 1.31.16 or later, 1.35.11 or later, or 1.39.4 or later.
Which versions of MediaWiki are affected by CVE-2019-12471?
CVE-2019-12471 affects MediaWiki versions 1.30.0 through 1.32.1 and some earlier versions.
What impact does CVE-2019-12471 have on MediaWiki applications?
CVE-2019-12471 allows an attacker to execute arbitrary JavaScript in the context of other users, leading to potential data theft or session hijacking.
Is user input validation affected by CVE-2019-12471?
Yes, CVE-2019-12471 highlights a failure in user input validation, specifically when loading JavaScript from unregistered user accounts.