Fluid Attacks Database

Description

Wikimedia information leak vulnerability Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak. Privileged API responses that include whether a recent change has been patrolled may be cached publicly. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1
debian 12	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1
debian 13	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1
packagist	mediawiki/core	>=1.27.0 <1.27.6 \|\| >=1.30.0 <1.30.2 \|\| >=1.31.0 <1.31.2 \|\| >=1.32.0 <1.32.2	1.27.6, 1.30.2, 1.31.2, 1.32.2
debian 14	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1

Aliases

1. CVE-2019-124742. NVD-2019-124743. OSV-DEBIAN-2019-124744. OSV-2019-124745. GCVE-2019-124746. SECURITY-TRACKER-CVE-2019-12474

References

1. https://github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2019-12474.yaml2. https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html3. https://phabricator.wikimedia.org/T2121184. https://seclists.org/bugtraq/2019/Jun/125. https://www.debian.org/security/2019/dsa-4460