CVE-2019-12470
Wikimedia MediaWik exposed suppressed log in RevisionDelete page
Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- Low
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
CVE-2019-12470- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:P/I:N/A:N - Weakness
- CWE-862
- Updated
- 2026-11-02
CVE List No score
Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
CVE-2019-12470- Updated
- 2026-11-02
EUVDEUVD-2022-2898 No score
Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
EUVD-2022-2898- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-733q-m38x-q7cc
Wikimedia MediaWik exposed suppressed log in RevisionDelete page
Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
GHSA-733q-m38x-q7cc- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
CVE-2019-12470- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-12470
Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
DEBIAN-CVE-2019-12470- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVGHSA-733q-m38x-q7cc
Wikimedia MediaWik exposed suppressed log in RevisionDelete page
Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
GHSA-733q-m38x-q7cc- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-12470
Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
UBUNTU-CVE-2019-12470- CVSS 3.0
- 6.5 Medium
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N - Updated
- 2026-11-02
OSVMGASA-2019-0279 No score
Updated mediawiki packages fix security vulnerabilities
Updated mediawiki packages fix security vulnerabilities:
Potential XSS in jQuery (CVE-2019-11358).
An account can be logged out without using a token (CSRF) (CVE-2019-12466).
A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability to block them (CVE-2019-12467).
Directly POSTing to Special:ChangeEmail would allow for bypassing reauthentication, allowing for potential account takeover (CVE-2019-12468).
Exposed suppressed username or log in Special:EditTags (CVE-2019-12469).
Exposed suppressed log in RevisionDelete page (CVE-2019-12470).
Loading user JavaScript from a non-existent account allows anyone to create the account, and XSS the users' loading that script (CVE-2019-12471).
It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit)
by using the API (CVE-2019-12472).
Passing invalid titles to the API could cause a DoS by querying the entire
watchlist table (CVE-2019-12473).
Privileged API responses that include whether a recent change has been patrolled may be cached publicly (CVE-2019-12474).
The mediawiki package has been updated to version 1.27.6 (Mageia 6) and 1.31.2 (Mageia 7), fixing these issues and other bugs. See the release announcements for more details.
- Record
MGASA-2019-0279- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawiki/corePackagist |
1.27.0 up to 1.27.6 | 1.27.6 |
mediawiki/corePackagist |
1.30.0 up to 1.30.2 | 1.30.2 |
mediawiki/corePackagist |
1.31.0 up to 1.31.2 | 1.31.2 |
mediawiki/corePackagist |
1.32.0 up to 1.32.2 | 1.32.2 |
mediawikiDebian:12 |
before 1:1.31.2-1 | 1:1.31.2-1 |
mediawikiDebian:13 |
before 1:1.31.2-1 | 1:1.31.2-1 |
mediawikiDebian:14 |
before 1:1.31.2-1 | 1:1.31.2-1 |
mediawikiDebian:9 From an advisory covering 10 CVEs |
before 1:1.27.7-1~deb9u1, plus listed versions 1:1.27.3-11:1.27.4-11:1.27.4-1~bpo8+11:1.27.4-1~deb9u11:1.27.4-21:1.27.4-31:1.27.5-1~deb9u11:1.27.6-1~deb9u1 |
1:1.27.7-1~deb9u1 |
mediawiki/corePackagist |
1.27.0 up to 1.27.6, plus listed versions 1.27.11.27.21.27.31.27.41.27.5 |
1.27.6 |
mediawiki/corePackagist |
1.30.0 up to 1.30.2, plus listed versions 1.30.1 |
1.30.2 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mediawiki/corePackagist |
1.31.0 up to 1.31.2, plus listed versions 1.31.1 |
1.31.2 |
mediawiki/corePackagist |
1.32.0 up to 1.32.2, plus listed versions 1.32.1 |
1.32.2 |
mediawikiMageia:6 From an advisory covering 10 CVEs |
before 1.27.7-1.mga6 | 1.27.7-1.mga6 |
mediawikiMageia:7 From an advisory covering 10 CVEs |
before 1.31.3-1.mga7 | 1.31.3-1.mga7 |
mediawikiUbuntu:18.04:LTS |
All versions, plus listed versions 1:1.27.3-11:1.27.4-11:1.27.4-21:1.27.4-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12470 is a medium vulnerability (CVSS 6.5) in Mediawiki, published June 12, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.36%, the 71st percentile. Fixed in mediawiki/core 1.27.6.
References
debian.org/security/2019/dsa-4460
seclists.org/bugtraq/2019/Jun/12
phabricator.wikimedia.org/T222038
lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html
nvd.nist.gov/vuln/detail/CVE-2019-12470
github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2019-12470.yaml
Show 10 moreShow less
security-tracker.debian.org/tracker/CVE-2019-12470
advisories.mageia.org/MGASA-2019-0279.html
bugs.mageia.org/show_bug.cgi?id=25273
ubuntu.com/security/CVE-2019-12470
cve.org/CVERecord?id=CVE-2019-12470