CVE-2019-12470

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

Metrics

CVSS 3.0 6.5/10CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Weakness enumeration

CWE-862

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.htmlMailing List, Release Notes, Vendor Advisory
https://phabricator.wikimedia.org/T222038Third Party Advisory
https://seclists.org/bugtraq/2019/Jun/12Issue Tracking, Mailing List, Third Party Advisory
https://www.debian.org/security/2019/dsa-4460Third Party Advisory
https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.htmlMailing List, Release Notes, Vendor Advisory
https://phabricator.wikimedia.org/T222038Third Party Advisory
https://seclists.org/bugtraq/2019/Jun/12Issue Tracking, Mailing List, Third Party Advisory
https://www.debian.org/security/2019/dsa-4460Third Party Advisory

Timeline

Published: Jul 10, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-124716.1Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, CVE-2019-124727.5An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP CVE-2019-124737.5Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchl CVE-2019-124747.5Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak. Privileged API responses that include whether a recent change has been pa CVE-2019-124756.1In MicroStrategy Web before 10.4.6, there is stored XSS in metric due to insufficient input validation.CVE-2019-124766.8An authentication bypass vulnerability in the password reset functionality in Zoho ManageEngine ADSelfService Plus before 5.0.6 allows an at CVE-2019-124775.5Supra Smart Cloud TV allows remote file inclusion in the openLiveURL function, which allows a local attacker to broadcast fake video without CVE-2019-124799.1An issue was discovered in 20|20 Storage 2.11.0. A Path Traversal vulnerability in the TwentyTwenty.Storage library in the LocalStorageProvi CVE-2019-12487.8A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database En CVE-2019-124807.5BACnet Protocol Stack through 0.8.6 has a segmentation fault leading to denial of service in BACnet APDU Layer because a malformed DCC in At CVE-2019-124815.5An issue was discovered in GPAC 0.7.1. There is a NULL pointer dereference in the function GetESD at isomedia/track.c in libgpac.a, as demon CVE-2019-124827.5An issue was discovered in GPAC 0.7.1. There is a NULL pointer dereference in the function gf_isom_get_original_format_type at isomedia/drm_