-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mediawiki/core | composer | < 1.27.6 | 1.27.6 |
| mediawiki/core | composer | >= 1.30.0, < 1.30.2 | 1.30.2 |
| mediawiki/core | composer | >= 1.31.0, < 1.31.2 | 1.31.2 |
| mediawiki/core | composer | >= 1.32.0, < 1.32.2 | 1.32.2 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability stemmed from missing access controls in the Special:ChangeEmail functionality. The Phabricator task T209794 specifically shows patches adding rate limiting (User::pingLimiter) and block checks to SpecialChangeEmail::execute. The CVE description confirms attackers could abuse this endpoint for spam due to missing rate limits. The execute function is the entry point for this special page's functionality, making it the logical location for the vulnerability before security controls were added.
Ongoing coverage of React2Shell