CRITICAL
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1
Published Jul 10, 2019
9.8
CRITICALCVSS 3.0
EPSS 3.33%
Description
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover.
Affected products
No data.
Configuration 2
- 9.0
No data.
No Red Hat product state for this CVE.
No package ranges for this CVE.
Remediation
No remediation recorded yet.
Weaknesses (2)
References (8)
- https://github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2019-12468.yaml
- https://github.com/advisories/GHSA-wrhx-3pxr-6vgg Advisory
- https://lists.wikimedia.org/pipermail/mediawiki-announce x_refsource_MISCThird Party Advisory
- https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html x_refsource_CONFIRMPatchThird Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2019-12468
- https://phabricator.wikimedia.org/T197279 x_refsource_MISCPatchThird Party Advisory
- https://seclists.org/bugtraq/2019/Jun/12 mailing-listx_refsource_BUGTRAQMailing ListThird Party Advisory
- https://www.debian.org/security/2019/dsa-4460 vendor-advisoryx_refsource_DEBIANThird Party Advisory
| Link | Providers | Tags |
|---|---|---|
| https://github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2019-12468.yaml | ||
| https://github.com/advisories/GHSA-wrhx-3pxr-6vgg | Advisory | |
| https://lists.wikimedia.org/pipermail/mediawiki-announce | x_refsource_MISCThird Party Advisory | |
| https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html | x_refsource_CONFIRMPatchThird Party Advisory | |
| https://nvd.nist.gov/vuln/detail/CVE-2019-12468 | ||
| https://phabricator.wikimedia.org/T197279 | x_refsource_MISCPatchThird Party Advisory | |
| https://seclists.org/bugtraq/2019/Jun/12 | mailing-listx_refsource_BUGTRAQMailing ListThird Party Advisory | |
| https://www.debian.org/security/2019/dsa-4460 | vendor-advisoryx_refsource_DEBIANThird Party Advisory |
Change history (0)
No recorded changes yet.
Sources
CVE.org / MITRE
Status PUBLISHED
Assigner mitre
Published Jul 10, 2019
Updated Aug 4, 2024
Reserved May 30, 2019
Link CVE-2019-12468
CISA Vulnrichment
GHSA-WRHX-3PXR-6VGG Updated n/a