CVE-2019-12472

Published: Jul 10, 2019Modified: Nov 21, 2024

7.5

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Exploitability: 3.9 / Impact: 3.6

Source: NVD

Description

An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

Affected (4)

Products: Mediawiki: Mediawiki

Mediawiki

1 product

Mediawiki

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Mediawiki Mediawiki	From 1.18.0 to 1.27.6
Mediawiki Mediawiki	From 1.30.0 to 1.30.2
Mediawiki Mediawiki	From 1.31.0 to 1.31.2
Mediawiki Mediawiki	From 1.32.0 to 1.32.2

References (4)

https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html

Source: cve@mitre.org

PatchThird Party Advisory

https://phabricator.wikimedia.org/T199540

Source: cve@mitre.org

Issue TrackingThird Party Advisory

https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html

Source: af854a3a-2127-422b-91ae-364da2661108

PatchThird Party Advisory

https://phabricator.wikimedia.org/T199540

Source: af854a3a-2127-422b-91ae-364da2661108

Issue TrackingThird Party Advisory

Timeline

No history available yet.