CVE-2012-4379: MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not send a restrictive X-Frame-Options HTTP header,...

Security readout for executives and security teams

Older MediaWiki versions failed to send a protective browser header on API responses. An attacker could frame those responses on another site and trick a logged-in user into interacting with hidden MediaWiki content. The sources describe clickjacking risk, not server compromise or data execution. Exposure is likely limited to organizations still running the affected MediaWiki release lines or downstream packages based on them. Public or authenticated wikis with users performing privileged actions face higher business relevance. Treat as a targeted user-interface security risk rather than an infrastructure emergency. Remediate during normal patch cycles unless the wiki is public-facing, highly privileged, or still running very old MediaWiki packages. Mitigation focus: Upgrade MediaWiki to 1.18.5, 1.19.2, or a later supported release.; Review Wikimedia and distribution advisories for package-specific fixes.; Ensure API responses send restrictive frame-control headers where supported..

Prepared

Jun 12, 2026, 20:36 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.