CVE-2012-4382

Published: Oct 19, 2017Modified: May 13, 2026

4.9

Vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: NVD

Description

MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not properly protect user block metadata, which allows remote administrators to read a user block reason via a reblock attempt.

Affected (3)

Products: Mediawiki: Mediawiki

Mediawiki

1 product

Mediawiki

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mediawiki Mediawiki	Up to 1.18.4
Mediawiki Mediawiki	Version 1.19.0
Mediawiki Mediawiki	Version 1.19.1

Related CWEs

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References (10)

http://www.openwall.com/lists/oss-security/2012/08/31/10

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

http://www.openwall.com/lists/oss-security/2012/08/31/6

Source: secalert@redhat.com

Mailing ListPatchThird Party Advisory

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330

Source: secalert@redhat.com

Issue TrackingThird Party Advisory

https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.html

Source: secalert@redhat.com

PatchVendor Advisory

https://phabricator.wikimedia.org/T41823

Source: secalert@redhat.com

Issue TrackingVendor Advisory

http://www.openwall.com/lists/oss-security/2012/08/31/10