CVE-2012-4380
UnknownEPSS 1.65%
Last modified
CVE-2012-4380 is a vulnerability of currently unknown severity. MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors.. EPSS estimates a 1.65% chance of exploitation in the next 30 days.
Description
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mediawiki | Mediawiki | <= 1.18.4 |
| Mediawiki | Mediawiki | 1.19.0 |
| Mediawiki | Mediawiki | 1.19.1 |
References
- http://www.openwall.com/lists/oss-security/2012/08/31/10Mailing List, Patch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2012/08/31/6Mailing List, Patch, Third Party Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330Issue Tracking, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=853440Issue Tracking
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.htmlPatch, Vendor Advisory
- https://phabricator.wikimedia.org/T41824Issue Tracking, Vendor Advisory
- http://www.openwall.com/lists/oss-security/2012/08/31/10Mailing List, Patch, Third Party Advisory
- http://www.openwall.com/lists/oss-security/2012/08/31/6Mailing List, Patch, Third Party Advisory
- https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=686330Issue Tracking, Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=853440Issue Tracking
- https://lists.wikimedia.org/pipermail/mediawiki-announce/2012-August/000119.htmlPatch, Vendor Advisory
- https://phabricator.wikimedia.org/T41824Issue Tracking, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2012-4380?
MediaWiki before 1.18.5, and 1.19.x before 1.19.2 allows remote attackers to bypass GlobalBlocking extension IP address blocking and create an account via unspecified vectors.
How severe is CVE-2012-4380?
Severity scoring for CVE-2012-4380 is pending analysis. The EPSS model estimates a 1.65% probability of exploitation in the next 30 days.
How do I fix CVE-2012-4380?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2012
- CVE-2012-4362hydra.exe in HP SAN/iQ before 9.5 on the HP Virtual SAN Appl…
- CVE-2012-4363Multiple unspecified vulnerabilities in Adobe Reader through…
- CVE-2012-4366Belkin wireless routers Surf N150 Model F7D1301v1, N900 Mode…
- CVE-2012-4377Cross-site scripting (XSS) vulnerability in MediaWiki before…
- CVE-2012-4378Multiple cross-site scripting (XSS) vulnerabilities in Media…
- CVE-2012-4379MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not s…
- CVE-2012-4381MediaWiki before 1.18.5, and 1.19.x before 1.19.2 saves pass…8.1
- CVE-2012-4382MediaWiki before 1.18.5, and 1.19.x before 1.19.2 does not p…
- CVE-2012-4383contao prior to 2.11.4 has a sql injection vulnerability8.8
- CVE-2012-4384letodms has multiple XSS issues: Reflected XSS in Login Page…6.1
- CVE-2012-4385letodms 3.3.6 has CSRF via change password6.5
- CVE-2012-4386The token check mechanism in Apache Struts 2.0.0 through 2.3…
Are you affected by CVE-2012-4380?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST