CVE-2019-12471: Loading JS from user space where the username is not a registered account is dangerous and should be banned

Q: What is the severity of CVE-2019-12471?

CVE-2019-12471 is classified as a medium severity vulnerability due to its potential for cross-site scripting (XSS) attacks.

Q: How do I fix CVE-2019-12471?

To fix CVE-2019-12471, upgrade to MediaWiki versions 1.31.16 or later, 1.35.11 or later, or 1.39.4 or later.

Q: Which versions of MediaWiki are affected by CVE-2019-12471?

CVE-2019-12471 affects MediaWiki versions 1.30.0 through 1.32.1 and some earlier versions.

Q: What impact does CVE-2019-12471 have on MediaWiki applications?

CVE-2019-12471 allows an attacker to execute arbitrary JavaScript in the context of other users, leading to potential data theft or session hijacking.

Q: Is user input validation affected by CVE-2019-12471?

Yes, CVE-2019-12471 highlights a failure in user input validation, specifically when loading JavaScript from unregistered user accounts.

Published Oct 21, 2018

Updated

Loading JS from user space where the username is not a registered account is dangerous and should be banned

Other sources

Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on users loading that script. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

Affected Software

12 affected componentsFixes available

composer/mediawiki/core>=1.27.0, <1.27.6, >=1.30.0, <1.30.2, >=1.31.0, <1.31.2

composer/mediawiki/core>=1.31.0<1.31.2

1.31.2

composer/mediawiki/core>=1.30.0<1.30.2

1.30.2

composer/mediawiki/core>=1.27.0<1.27.6

1.27.6

MediaWiki MediaWiki>=1.30.0<1.30.2

MediaWiki MediaWiki>=1.31.0<1.31.2

MediaWiki MediaWiki>=1.32.0<1.32.2

Debian Debian Linux=9.0

composer/mediawiki/core>=1.27.0, <1.27.6

1.27.6

composer/mediawiki/core>=1.30.0, <1.30.2

1.30.2

composer/mediawiki/core>=1.31.0, <1.31.2

1.31.2

debian/mediawiki

1:1.39.17-1+deb12u21:1.43.9+dfsg-1~deb13u11:1.43.11+dfsg-3

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/mediawiki/core to a version that resolves this vulnerability.
Fixed in 1.31.2
Upgrade
Upgrade composer/mediawiki/core to a version that resolves this vulnerability.
Fixed in 1.30.2
Upgrade
Upgrade composer/mediawiki/core to a version that resolves this vulnerability.
Fixed in 1.27.6
Upgrade
Upgrade debian/mediawiki to a version that resolves this vulnerability.
Fixed in 1:1.39.17-1+deb12u2Fixed in 1:1.43.9+dfsg-1~deb13u1Fixed in 1:1.43.11+dfsg-3
Upgrade
Upgrade Wikimedia MediaWiki to a version that resolves this vulnerability.
Fixed in 1.32.2
Upgrade
Upgrade Wikimedia MediaWiki to a version that resolves this vulnerability.
Fixed in 1.31.2
Upgrade
Upgrade Wikimedia MediaWiki to a version that resolves this vulnerability.
Fixed in 1.30.2
Upgrade
Upgrade Wikimedia MediaWiki to a version that resolves this vulnerability.
Fixed in 1.27.6
Compensating control
Ban loading JavaScript from user space when the username is not a registered account.

Event History

Oct 21, 2018

Advisory Published

via Packagist·06:05 PM

Data Sourced

via Packagist·06:05 PM

DescriptionSeverityAffected Software

Advisory Published

07:09 PM

Jul 10, 2019

CVE Published

via MITRE·03:49 PM

Data Sourced

via MITRE·03:49 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

DSA-4460

Frequently Asked Questions

What is the severity of CVE-2019-12471?