CVE-2019-12472
MediaWiki Incorrect Access Control vulnerability
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
CVE-2019-12472- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Updated
- 2026-11-02
CVE List No score
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
CVE-2019-12472- Updated
- 2026-11-02
EUVDEUVD-2022-3036 No score
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
EUVD-2022-3036- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7mqg-5fgh-xh4r
MediaWiki Incorrect Access Control vulnerability
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
GHSA-7mqg-5fgh-xh4r- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSV
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
CVE-2019-12472- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-12472
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
DEBIAN-CVE-2019-12472- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVGHSA-7mqg-5fgh-xh4r
MediaWiki Incorrect Access Control vulnerability
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
GHSA-7mqg-5fgh-xh4r- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-12472
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
UBUNTU-CVE-2019-12472- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2019-0279 No score
Updated mediawiki packages fix security vulnerabilities
Updated mediawiki packages fix security vulnerabilities:
Potential XSS in jQuery (CVE-2019-11358).
An account can be logged out without using a token (CSRF) (CVE-2019-12466).
A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability to block them (CVE-2019-12467).
Directly POSTing to Special:ChangeEmail would allow for bypassing reauthentication, allowing for potential account takeover (CVE-2019-12468).
Exposed suppressed username or log in Special:EditTags (CVE-2019-12469).
Exposed suppressed log in RevisionDelete page (CVE-2019-12470).
Loading user JavaScript from a non-existent account allows anyone to create the account, and XSS the users' loading that script (CVE-2019-12471).
It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit)
by using the API (CVE-2019-12472).
Passing invalid titles to the API could cause a DoS by querying the entire
watchlist table (CVE-2019-12473).
Privileged API responses that include whether a recent change has been patrolled may be cached publicly (CVE-2019-12474).
The mediawiki package has been updated to version 1.27.6 (Mageia 6) and 1.31.2 (Mageia 7), fixing these issues and other bugs. See the release announcements for more details.
- Record
MGASA-2019-0279- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawiki/corePackagist |
1.18.0 up to 1.27.6 | 1.27.6 |
mediawiki/corePackagist |
1.30.0 up to 1.30.2 | 1.30.2 |
mediawiki/corePackagist |
1.31.0 up to 1.31.2 | 1.31.2 |
mediawiki/corePackagist |
1.32.0 up to 1.32.2 | 1.32.2 |
mediawikiDebian:12 |
before 1:1.31.2-1 | 1:1.31.2-1 |
mediawikiDebian:13 |
before 1:1.31.2-1 | 1:1.31.2-1 |
mediawikiDebian:14 |
before 1:1.31.2-1 | 1:1.31.2-1 |
mediawikiDebian:9 From an advisory covering 10 CVEs |
before 1:1.27.7-1~deb9u1, plus listed versions 1:1.27.3-11:1.27.4-11:1.27.4-1~bpo8+11:1.27.4-1~deb9u11:1.27.4-21:1.27.4-31:1.27.5-1~deb9u11:1.27.6-1~deb9u1 |
1:1.27.7-1~deb9u1 |
mediawiki/corePackagist |
1.18.0 up to 1.27.6, plus listed versions 1.20.31.20.41.20.51.20.61.20.7 Show 45 moreShow less1.20.81.21.01.21.11.21.101.21.111.21.21.21.31.21.41.21.51.21.61.21.71.21.81.21.91.22.0rc01.24.01.24.0-rc.01.24.0-rc.11.24.0-rc.21.24.0-rc.31.24.11.24.21.24.31.24.41.24.51.24.61.25.01.25.0-rc.01.25.11.25.21.25.31.25.41.25.51.25.61.26.01.26.11.26.21.26.31.26.41.27.01.27.0-rc.01.27.0-rc.11.27.11.27.21.27.31.27.4 |
1.27.6 |
mediawiki/corePackagist |
1.30.0 up to 1.30.2, plus listed versions 1.30.1 |
1.30.2 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mediawiki/corePackagist |
1.31.0 up to 1.31.2, plus listed versions 1.31.1 |
1.31.2 |
mediawiki/corePackagist |
1.32.0 up to 1.32.2, plus listed versions 1.32.1 |
1.32.2 |
mediawikiMageia:6 From an advisory covering 10 CVEs |
before 1.27.7-1.mga6 | 1.27.7-1.mga6 |
mediawikiMageia:7 From an advisory covering 10 CVEs |
before 1.31.3-1.mga7 | 1.31.3-1.mga7 |
mediawikiUbuntu:18.04:LTS |
All versions, plus listed versions 1:1.27.3-11:1.27.4-11:1.27.4-21:1.27.4-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12472 is a high vulnerability (CVSS 7.5) in Mediawiki, published June 12, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.32%, the 71st percentile. Fixed in mediawiki/core 1.27.6.
References
phabricator.wikimedia.org/T199540
lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html
nvd.nist.gov/vuln/detail/CVE-2019-12472
github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2019-12472.yaml
security-tracker.debian.org/tracker/CVE-2019-12472
Show 8 moreShow less
advisories.mageia.org/MGASA-2019-0279.html
bugs.mageia.org/show_bug.cgi?id=25273
ubuntu.com/security/CVE-2019-12472
cve.org/CVERecord?id=CVE-2019-12472
Left out here: 1 version. The JSON record has them.