CVE-2020-12051

2020-04-2122:15:14

Google

osv.dev

6.5 Medium

AI Score

Confidence

Low

0.007 Low

EPSS

Percentile

80.1%

JSON

The CentralAuth extension through REL1_34 for MediaWiki allows remote attackers to obtain sensitive hidden account information via an api.php?action=query&meta=globaluserinfo&guiuser= request. In other words, the information can be retrieved via the action API even though access would be denied when simply visiting wiki/Special:CentralAuth in a web browser.

CPENameOperatorVersion
mediawikieq1.34.0
mediawikieq1.5.0beta1
mediawikieq1.5.0beta2
mediawikieq1.5.0beta3
mediawikieq1.5.0beta4
mediawikieq1.1.0
mediawikieq1.34.0-rc.0
mediawikieq1.5.0alpha1
mediawikieq1.3.0beta1
mediawikieq1.34.0-rc.1

Name	Operator	Version
mediawiki	eq	1.34.0
mediawiki	eq	1.5.0beta1
mediawiki	eq	1.5.0beta2
mediawiki	eq	1.5.0beta3
mediawiki	eq	1.5.0beta4
mediawiki	eq	1.1.0
mediawiki	eq	1.34.0-rc.0
mediawiki	eq	1.5.0alpha1
mediawiki	eq	1.3.0beta1
mediawiki	eq	1.34.0-rc.1