Fluid Attacks Database

Description

MediaWiki Incorrect Access Control vulnerability MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 11	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1
debian 13	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1
packagist	mediawiki/core	>=1.27.0 <1.27.6 \|\| >=1.30.0 <1.30.2 \|\| >=1.31.0 <1.31.2 \|\| >=1.32.0 <1.32.2	1.27.6, 1.30.2, 1.31.2, 1.32.2
debian 12	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1
debian 14	mediawiki	>=0 <1:1.31.2-1	1:1.31.2-1

Aliases

1. CVE-2019-124692. NVD-2019-124693. OSV-DEBIAN-2019-124694. OSV-2019-124695. GCVE-2019-124696. SECURITY-TRACKER-CVE-2019-12469

References

1. https://github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2019-12469.yaml2. https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html3. https://phabricator.wikimedia.org/T2220364. https://seclists.org/bugtraq/2019/Jun/125. https://www.debian.org/security/2019/dsa-4460