VDB
Sign up
CRITICAL9.8

GHSA-wrhx-3pxr-6vgg

Wikimedia MediaWiki Incorrect Access Control vulnerability

Quick fix

GHSA-wrhx-3pxr-6vgg — mediawiki/core: upgrade to the fixed version with the command below.

composer require mediawiki/core:^1.27.6

Details

An Incorrect Access Control vulnerability was found in Wikimedia MediaWiki 1.27.0 through 1.32.1. Directly POSTing to Special:ChangeEmail would allow for bypassing re-authentication, allowing for potential account takeover.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/mediawiki/core
Introduced in: 1.27.0Fixed in: 1.27.6
Fixcomposer require mediawiki/core:^1.27.6
Packagist/mediawiki/core
Introduced in: 1.30.0Fixed in: 1.30.2
Fixcomposer require mediawiki/core:^1.30.2
Packagist/mediawiki/core
Introduced in: 1.31.0Fixed in: 1.31.2
Fixcomposer require mediawiki/core:^1.31.2
Packagist/mediawiki/core
Introduced in: 1.32.0Fixed in: 1.32.2
Fixcomposer require mediawiki/core:^1.32.2

References