Medium severity · published Oct 29, 2019
CVE-2019-18612
An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki
5.3
CVSS
0.9%
EPSS
No
On KEV
Description
An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Previously hidden (restricted) AbuseFilter filters were viewable (or their differences were viewable) to unprivileged users, thus disclosing potentially sensitive information.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
Low
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
AB
Abusefilter · Mediawiki
through 1.34 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-18612
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-18612
Patch
https://gerrit.wikimedia.org/r/q/Ie23e8234ae550273bf3f6f9c5ac45b7fc54eec2a
Patch
https://phabricator.wikimedia.org/T104807
More from Abusefilter
7.5
CVE-2019-16528
An issue was discovered in the AbuseFilter extension for MediaWiki
5.3
CVE-2019-18987
An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki