A vulnerability, which was classified as problematic, has been found in Wikimedia MediaWiki up to 1.27.5/1.30.1/1.31.1/1.32.1 (Content Management System). This issue affects some unknown processing of the component RevisionDelete Page. The manipulation with an unknown input leads to a access control vulnerability. Using CWE to declare the problem leads to CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. Impacted is confidentiality. The summary by CVE is:

Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

The weakness was published 07/10/2019 as not defined mailinglist post (Bugtraq). It is possible to read the advisory at seclists.org. The identification of this vulnerability is CVE-2019-12470 since 05/30/2019. The attack may be initiated remotely. Required for exploitation is a simple authentication. The technical details are unknown and an exploit is not publicly available. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

Upgrading to version 1.27.6, 1.30.2, 1.31.2 or 1.32.2 eliminates this vulnerability.

Similar entries are available at 137671, 137672, 137673 and 137674.

Productinfo

Type

• Content Management System

Vendor

• Wikimedia

Name

• MediaWiki

Version

• 1.27.0
• 1.27.1
• 1.27.2
• 1.27.3
• 1.27.4
• 1.27.5
• 1.30.0
• 1.30.1
• 1.31.0
• 1.31.1
• 1.32.0
• 1.32.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion