PT-2019-5357 · Wikimedia+1 · Mediawiki+1

Lucas Werkmeister + 1 · Publicado 2017-08-22 · Atualizado 2025-09-29 · CVE-2019-12474

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.23.0 through 1.32.1

Description The issue is related to an information leak in MediaWiki, where privileged API responses may be cached publicly, potentially revealing whether a recent change has been patrolled. This could allow a remote attacker to gain unauthorized access to protected information.

Recommendations For MediaWiki versions 1.23.0 through 1.32.1, update to version 1.32.2, 1.31.2, 1.30.2, or 1.27.6 to resolve the issue.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALSA-2025_16880

ALT-PU-2017-2095

ALT-PU-2019-2016

ALT-PU-2019-2054

BDU:2020-02564

CVE-2019-12474

DSA-4460-1

GHSA-2QRR-C2GH-PR35

MGASA-2019-0279

Produtos afetados

Alt Linux

Mediawiki

Referências · 23

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2019-12474.yaml · Exploit
• https://github.com/wikimedia/mediawiki · Nota
• https://strelets.net/patchi-i-obnovleniya-bezopasnosti#16012023 · Nota
• https://osv.dev/vulnerability/CVE-2019-12474 · Aviso do Fabricante
• https://lists.wikimedia.org/pipermail/wikitech-l/2019-June/092152.html · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2019-12474 · Nota de Segurança
• https://debian.org/security/2019/dsa-4460 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2019-12474 · Aviso do Fabricante
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2019-July/000234.html · Nota
• https://advisories.mageia.org/MGASA-2019-0279.html · Nota de Segurança
• https://phabricator.wikimedia.org/T212118 · Correção
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2019-June/000232.html · Nota
• https://osv.dev/vulnerability/GHSA-2qrr-c2gh-pr35 · Aviso do Fabricante
• https://osv.dev/vulnerability/DSA-4460-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2019-12474 · Aviso do Fabricante