VDB
Sign up
HIGH7.5

GHSA-7mqg-5fgh-xh4r

MediaWiki Incorrect Access Control vulnerability

Quick fix

GHSA-7mqg-5fgh-xh4r — mediawiki/core: upgrade to the fixed version with the command below.

composer require mediawiki/core:^1.27.6

Details

An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.18.0 through 1.32.1. It is possible to bypass the limits on IP range blocks ($wgBlockCIDRLimit) by using the API. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/mediawiki/core
Introduced in: 1.18.0Fixed in: 1.27.6
Fixcomposer require mediawiki/core:^1.27.6
Packagist/mediawiki/core
Introduced in: 1.30.0Fixed in: 1.30.2
Fixcomposer require mediawiki/core:^1.30.2
Packagist/mediawiki/core
Introduced in: 1.31.0Fixed in: 1.31.2
Fixcomposer require mediawiki/core:^1.31.2
Packagist/mediawiki/core
Introduced in: 1.32.0Fixed in: 1.32.2
Fixcomposer require mediawiki/core:^1.32.2

References