CVE-2019-12473
Wikimedia Potential DOS due to slow WatchedItemStore::countVisitingWatchersMultiple
Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
CVE-2019-12473- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Updated
- 2026-11-02
CVE List No score
Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
CVE-2019-12473- Updated
- 2026-11-02
EUVDEUVD-2022-2100 No score
Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
EUVD-2022-2100- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-33xw-x3pr-rvqj
Wikimedia Potential DOS due to slow WatchedItemStore::countVisitingWatchersMultiple
Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
GHSA-33xw-x3pr-rvqj- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSV
Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
CVE-2019-12473- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVDEBIAN-CVE-2019-12473
Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
DEBIAN-CVE-2019-12473- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVGHSA-33xw-x3pr-rvqj
Wikimedia Potential DOS due to slow WatchedItemStore::countVisitingWatchersMultiple
Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
GHSA-33xw-x3pr-rvqj- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-400
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2019-12473
Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- Record
UBUNTU-CVE-2019-12473- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVMGASA-2019-0279 No score
Updated mediawiki packages fix security vulnerabilities
Updated mediawiki packages fix security vulnerabilities:
Potential XSS in jQuery (CVE-2019-11358).
An account can be logged out without using a token (CSRF) (CVE-2019-12466).
A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability to block them (CVE-2019-12467).
Directly POSTing to Special:ChangeEmail would allow for bypassing reauthentication, allowing for potential account takeover (CVE-2019-12468).
Exposed suppressed username or log in Special:EditTags (CVE-2019-12469).
Exposed suppressed log in RevisionDelete page (CVE-2019-12470).
Loading user JavaScript from a non-existent account allows anyone to create the account, and XSS the users' loading that script (CVE-2019-12471).
It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit)
by using the API (CVE-2019-12472).
Passing invalid titles to the API could cause a DoS by querying the entire
watchlist table (CVE-2019-12473).
Privileged API responses that include whether a recent change has been patrolled may be cached publicly (CVE-2019-12474).
The mediawiki package has been updated to version 1.27.6 (Mageia 6) and 1.31.2 (Mageia 7), fixing these issues and other bugs. See the release announcements for more details.
- Record
MGASA-2019-0279- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawiki/corePackagist |
1.27.0 up to 1.27.6 | 1.27.6 |
mediawiki/corePackagist |
1.30.0 up to 1.30.2 | 1.30.2 |
mediawiki/corePackagist |
1.31.0 up to 1.31.2 | 1.31.2 |
mediawiki/corePackagist |
1.32.0 up to 1.32.2 | 1.32.2 |
mediawikiDebian:12 |
before 1:1.31.2-1 | 1:1.31.2-1 |
mediawikiDebian:13 |
before 1:1.31.2-1 | 1:1.31.2-1 |
mediawikiDebian:14 |
before 1:1.31.2-1 | 1:1.31.2-1 |
mediawikiDebian:9 From an advisory covering 10 CVEs |
before 1:1.27.7-1~deb9u1, plus listed versions 1:1.27.3-11:1.27.4-11:1.27.4-1~bpo8+11:1.27.4-1~deb9u11:1.27.4-21:1.27.4-31:1.27.5-1~deb9u11:1.27.6-1~deb9u1 |
1:1.27.7-1~deb9u1 |
mediawiki/corePackagist |
1.27.0 up to 1.27.6, plus listed versions 1.27.11.27.21.27.31.27.41.27.5 |
1.27.6 |
mediawiki/corePackagist |
1.30.0 up to 1.30.2, plus listed versions 1.30.1 |
1.30.2 |
Show 5 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mediawiki/corePackagist |
1.31.0 up to 1.31.2, plus listed versions 1.31.1 |
1.31.2 |
mediawiki/corePackagist |
1.32.0 up to 1.32.2, plus listed versions 1.32.1 |
1.32.2 |
mediawikiMageia:6 From an advisory covering 10 CVEs |
before 1.27.7-1.mga6 | 1.27.7-1.mga6 |
mediawikiMageia:7 From an advisory covering 10 CVEs |
before 1.31.3-1.mga7 | 1.31.3-1.mga7 |
mediawikiUbuntu:18.04:LTS |
All versions, plus listed versions 1:1.27.3-11:1.27.4-11:1.27.4-21:1.27.4-3 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2019-12473 is a high vulnerability (CVSS 7.5) in Mediawiki, published June 12, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.31%, the 83rd percentile. Fixed in mediawiki/core 1.27.6.
References
debian.org/security/2019/dsa-4460
seclists.org/bugtraq/2019/Jun/12
phabricator.wikimedia.org/T204729
lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html
nvd.nist.gov/vuln/detail/CVE-2019-12473
github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2019-12473.yaml
Show 10 moreShow less
security-tracker.debian.org/tracker/CVE-2019-12473
advisories.mageia.org/MGASA-2019-0279.html
bugs.mageia.org/show_bug.cgi?id=25273
ubuntu.com/security/CVE-2019-12473
cve.org/CVERecord?id=CVE-2019-12473