CVE-2019-12472

HIGH

MediaWiki 1.18.0-1.32.1 - Incorrect Access Control via API

Title source: llm

Description

An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

References (2)

Core 2

Core References

Issue Tracking, Third Party Advisory x_refsource_misc

https://phabricator.wikimedia.org/T199540

Patch, Third Party Advisory x_refsource_confirm

https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html

Scores

CVSS v3 7.5

EPSS 0.0015

EPSS Percentile 35.3%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Details

Status published

Products (2)

mediawiki/core 1.18.0 - 1.27.6Packagist

mediawiki/mediawiki 1.18.0 - 1.27.6

Published Jul 10, 2019

Tracked Since Feb 18, 2026