CVE-2019-12468
Publication date 10 July 2019
Last updated 26 August 2025
Ubuntu priority
Description
An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover.
Status
| Package | Ubuntu Release | Status |
|---|---|---|
| mediawiki | 26.04 LTS resolute |
Fixed 1:1.31.2-1
|
| 25.10 questing |
Fixed 1:1.31.2-1
|
|
| 24.04 LTS noble |
Fixed 1:1.31.2-1
|
|
| 22.04 LTS jammy |
Fixed 1:1.31.2-1
|
|
| 20.04 LTS focal |
Fixed 1:1.31.2-1
|
|
| 18.04 LTS bionic |
Vulnerable
|
|
| 16.04 LTS xenial | Not in release | |
| 14.04 LTS trusty | Not in release |
Severity score breakdown
| Parameter | Value |
|---|---|
| Base score |
9.8 · Critical
|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality | High |
| Integrity impact | High |
| Availability impact | High |
| Vector | CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |