VDB
Sign up
MEDIUM5.3

GHSA-6vfg-8ppv-h5hg

MediaWiki Incorrect Access Control vulnerability

Quick fix

GHSA-6vfg-8ppv-h5hg — mediawiki/core: upgrade to the fixed version with the command below.

composer require mediawiki/core:^1.27.6

Details

MediaWiki through 1.32.1 has Incorrect Access Control (issue 1 of 3). A spammer can use Special:ChangeEmail to send out spam with no rate limiting or ability to block them. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/mediawiki/core
Introduced in: 0Fixed in: 1.27.6
Fixcomposer require mediawiki/core:^1.27.6
Packagist/mediawiki/core
Introduced in: 1.30.0Fixed in: 1.30.2
Fixcomposer require mediawiki/core:^1.30.2
Packagist/mediawiki/core
Introduced in: 1.31.0Fixed in: 1.31.2
Fixcomposer require mediawiki/core:^1.31.2
Packagist/mediawiki/core
Introduced in: 1.32.0Fixed in: 1.32.2
Fixcomposer require mediawiki/core:^1.32.2

References