VulnerableCode Package Details - pkg:deb/ubuntu/mediawiki@1:1.31.1-3

Search for packages

Package details: pkg:deb/ubuntu/mediawiki@1:1.31.1-3

Essentials
History (0)

purl	pkg:deb/ubuntu/mediawiki@1:1.31.1-3

Next non-vulnerable version	1:1.31.7-1
Latest non-vulnerable version	1:1.31.7-1
Risk	4.5

Vulnerabilities affecting this package (11)

Vulnerability	Summary	Fixed by
VCID-2txe-5685-aaar Aliases: CVE-2019-12467 GHSA-6vfg-8ppv-h5hg	MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3). A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability to block them. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.	1:1.31.2-1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-4q2b-jwqb-aaas Aliases: CVE-2019-12470 GHSA-733q-m38x-q7cc	Wikimedia MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed log in RevisionDelete page is exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.	1:1.31.2-1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-8ex1-6xse-aaab Aliases: CVE-2019-19709 GHSA-pjv5-vv93-p648	MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.	1:1.31.6-1 Affected by 1 other vulnerability. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }}
VCID-aap7-715h-aaab Aliases: CVE-2019-12472 GHSA-7mqg-5fgh-xh4r	An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.	1:1.31.2-1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-bhgn-gct9-aaae Aliases: CVE-2019-12466 GHSA-27fw-r78j-h898	Wikimedia MediaWiki through 1.32.1 allows CSRF.	1:1.31.2-1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-f9ks-vah3-aaaa Aliases: CVE-2019-12474 GHSA-2qrr-c2gh-pr35	Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak. Privileged API responses that include whether a recent change has been patrolled may be cached publicly. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.	1:1.31.2-1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-fwhc-xtwd-aaag Aliases: CVE-2019-12469 GHSA-x3fr-w7r5-x7rg	MediaWiki through 1.32.1 has Incorrect Access Control. Suppressed username or log in Special:EditTags are exposed. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.	1:1.31.2-1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-k3vw-m137-aaan Aliases: CVE-2020-10960 GHSA-pfm2-mqwj-ggm5	In MediaWiki before 1.34.1, users can add various Cascading Style Sheets (CSS) classes (which can affect what content is shown or hidden in the user interface) to arbitrary DOM nodes via HTML content within a MediaWiki page. This occurs because jquery.makeCollapsible allows applying an event handler to any Cascading Style Sheets (CSS) selector. There is no known way to exploit this for cross-site scripting (XSS).	1:1.31.7-1 Affected by 0 other vulnerabilities.
VCID-qynw-xq2t-aaap Aliases: CVE-2019-12468 GHSA-wrhx-3pxr-6vgg	An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover.	1:1.31.2-1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-tm36-42qs-aaah Aliases: CVE-2019-12471 GHSA-2rm7-xxx8-35jh	Wikimedia MediaWiki 1.30.0 through 1.32.1 has XSS. Loading user JavaScript from a non-existent account allows anyone to create the account, and perform XSS on users loading that script. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.	1:1.31.2-1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}
VCID-zqf1-jg5k-aaap Aliases: CVE-2019-12473 GHSA-33xw-x3pr-rvqj	Wikimedia MediaWiki 1.27.0 through 1.32.1 might allow DoS. Passing invalid titles to the API could cause a DoS by querying the entire watchlist table. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.	1:1.31.2-1 Affected by 2 other vulnerabilities. This version is affected by these other vulnerabilities: {{ fixed_by_vuln.vulnerability_id }} {{ fixed_by_vuln.vulnerability_id }}

Vulnerabilities fixed by this package (0)

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version