LiveActive security incident?Get immediate response
CVE Record

CVE-2019-12474: Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak.

Wikimedia MediaWiki 1.23.0 through 1.32.1 has an information leak. Privileged API responses that include whether a recent change has been patrolled may be cached publicly. Fixed in 1.32.2, 1.31.2, 1.30.2 and 1.27.6.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

This flaw can expose whether a recent MediaWiki change was patrolled when privileged API responses are cached publicly. It is an information leak, not described as code execution or authentication bypass in the supplied sources. Organizations running affected MediaWiki versions should prioritize patching because leaked moderation state can reveal internal review activity.

Executive priority

Treat this as a timely patching item for affected MediaWiki sites. It is not documented here as actively exploited or system-compromising, but public leakage of privileged moderation status can create governance, privacy, and operational trust concerns.

Technical view

MediaWiki 1.23.0 through 1.32.1 may publicly cache privileged API responses containing recent-change patrol status. Fixed releases are 1.32.2, 1.31.2, 1.30.2, and 1.27.6. The supplied bundle provides no CVSS, CWE, or exploit mechanics.

Likely exposure

Exposure is most likely on public or semi-public MediaWiki sites running 1.23.0 through 1.32.1, especially where API responses pass through shared caches, CDNs, or reverse proxies.

Exploitation context

The source bundle does not report active exploitation, and KEV status is false. The risk is unauthorized disclosure of privileged moderation metadata through caching behavior, not direct system compromise based on the supplied evidence.

Researcher notes

Focus validation on version exposure and cache behavior around privileged API responses. The supplied sources do not provide CVSS, CWE classification, exploit status, or detailed trigger conditions beyond public caching of patrol-status data.

Mitigation direction

  • Upgrade MediaWiki to 1.32.2, 1.31.2, 1.30.2, 1.27.6, or later supported releases.
  • Apply the Debian DSA-4460 security update where MediaWiki is installed from Debian packages.
  • Review CDN, reverse proxy, and application cache handling for privileged API responses.
  • Check Wikimedia and distribution guidance for branch-specific remediation details.

Validation and detection

  • Inventory all MediaWiki instances and record exact application and package versions.
  • Confirm no deployment remains on MediaWiki 1.23.0 through 1.32.1 without the fixed release.
  • Review cache configuration for API endpoints returning privileged or user-specific metadata.
  • Check access logs for unusual retrieval of cached API responses if logs are available.
Prepared
Confidence
medium
Sources
6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-12474 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
5Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.