Fluid Attacks Database

Description

MediaWiki Incorrect Access Control vulnerability MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3). A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability to block them. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1
debian 12	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1
packagist	mediawiki/core	>=0 <1.27.6 \|\| >=1.30.0 <1.30.2 \|\| >=1.31.0 <1.31.2 \|\| >=1.32.0 <1.32.2	1.27.6, 1.30.2, 1.31.2, 1.32.2
debian 13	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1
debian 14	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1

Aliases

1. CVE-2019-124672. NVD-2019-124673. OSV-DEBIAN-2019-124674. OSV-2019-124675. GCVE-2019-124676. SECURITY-TRACKER-CVE-2019-12467

References

1. https://github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2019-12467.yaml2. https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html3. https://phabricator.wikimedia.org/T2097944. https://seclists.org/bugtraq/2019/Jun/125. https://www.debian.org/security/2019/dsa-4460