Missing Authorization
CVE-2019-12470
Summary
Wikimedia MediaWiki 1.27.x through 1.27.5, 1.28.x through 1.30.1, 1.31.x through 1.31.1, and 1.32.x through 1.32.1, has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.
- LOW
- NETWORK
- NONE
- UNCHANGED
- NONE
- LOW
- HIGH
- NONE
CWE-862 - Missing Authorization
The missing authorization vulnerability occurs when a software program allows users to access privileged parts of the program without verifying the user credentials. Impact of such a vulnerability depends on the resources employed by the software, ranging from account takeover to sensitive information exposure, denial of service, and complete system takeover.
References
Advisory Timeline
- Published