Fluid Attacks Database

Description

Wikimedia MediaWik exposed suppressed log in RevisionDelete page Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 14	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1
debian 12	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1
packagist	mediawiki/core	>=1.27.0 <1.27.6 \|\| >=1.30.0 <1.30.2 \|\| >=1.31.0 <1.31.2 \|\| >=1.32.0 <1.32.2	1.27.6, 1.30.2, 1.31.2, 1.32.2
debian 11	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1
debian 13	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1

Aliases

1. CVE-2019-124702. NVD-2019-124703. OSV-DEBIAN-2019-124704. OSV-2019-124705. GCVE-2019-124706. SECURITY-TRACKER-CVE-2019-12470

References

1. https://github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2019-12470.yaml2. https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html3. https://phabricator.wikimedia.org/T2220384. https://seclists.org/bugtraq/2019/Jun/125. https://www.debian.org/security/2019/dsa-4460