Fluid Attacks Database

Description

MediaWiki Cross-site Scripting (XSS) Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on users loading that script. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
packagist	mediawiki/core	>=1.27.0 <1.27.6 \|\| >=1.30.0 <1.30.2 \|\| >=1.31.0 <1.31.2	1.27.6, 1.30.2, 1.31.2
debian 13	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1
debian 14	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1
debian 11	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1
debian 12	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1

Aliases

1. CVE-2019-124712. NVD-2019-124713. OSV-2019-124714. OSV-DEBIAN-2019-124715. GCVE-2019-124716. SECURITY-TRACKER-CVE-2019-12471

References

1. https://github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2019-12471.yaml2. https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html3. https://phabricator.wikimedia.org/T2076034. https://seclists.org/bugtraq/2019/Jun/125. https://www.debian.org/security/2019/dsa-4460