Read the docs
TI-2019-09311 Aliases CVE-2019-12470GHSA-733q-m38x-q7cc

Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control.

Priority LOW 32CWE-862Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-862.

Summary

Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

Why it matters now

EPSS 0.01356 71st percentileScored 2026-11-07
Fix Fixed mediawiki/core (Packagist): 1.27.6, 1.30.2, 1.31.2 +1

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—mediawiki/core (Packagist)1.27.0 to before 1.27.61.27.6Patch availableGHSA-733q-m38x-q7cc
—mediawiki/core (Packagist)1.30.0 to before 1.30.21.30.2Patch availableGHSA-733q-m38x-q7cc
—mediawiki/core (Packagist)1.31.0 to before 1.31.21.31.2Patch availableGHSA-733q-m38x-q7cc
—mediawiki/core (Packagist)1.32.0 to before 1.32.21.32.2Patch availableGHSA-733q-m38x-q7cc
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • mediawiki/core (Packagist) Vendor— Affected 1.27.0 to before 1.27.6 Fixed in 1.27.6 Patch available GHSA-733q-m38x-q7cc
  • mediawiki/core (Packagist) Vendor— Affected 1.30.0 to before 1.30.2 Fixed in 1.30.2 Patch available GHSA-733q-m38x-q7cc
  • mediawiki/core (Packagist) Vendor— Affected 1.31.0 to before 1.31.2 Fixed in 1.31.2 Patch available GHSA-733q-m38x-q7cc
  • mediawiki/core (Packagist) Vendor— Affected 1.32.0 to before 1.32.2 Fixed in 1.32.2 Patch available GHSA-733q-m38x-q7cc

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*before 1.27.6; 1.27.7 to before 1.30.2; 1.31.0 to before 1.31.2; 1.32.0 to before 1.32.2Vulnerablemediawiki
cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:*9.0VulnerableDebian
  • cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:* Versions before 1.27.6; 1.27.7 to before 1.30.2; 1.31.0 to before 1.31.2; 1.32.0 to before 1.32.2 Vulnerable ·mediawiki
  • cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-733q-m38x-q7cc mediawiki/core (Packagist) Fixed in 1.27.6 Advisory →
  • Fix · GHSA-733q-m38x-q7cc mediawiki/core (Packagist) Fixed in 1.30.2 Advisory →
  • Fix · GHSA-733q-m38x-q7cc mediawiki/core (Packagist) Fixed in 1.31.2 Advisory →
  • Fix · GHSA-733q-m38x-q7cc mediawiki/core (Packagist) Fixed in 1.32.2 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2019-12470
  2. 2026-10-03 Alias added: GHSA-733q-m38x-q7cc

References

Advisory 5

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences