PT-2019-15536 · Mediawiki · Mediawiki Checkuser Extension

Umherirrender · Published 2019-10-29 · Updated 2019-10-31 · CVE-2019-18611

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki CheckUser extension versions through 1.34

Description An issue in the CheckUser extension for MediaWiki potentially exposed sensitive information within oversighted edit summaries to users with various levels of access. This sensitive information was made available via the MediaWiki API, allowing unauthorized access to data that should have been restricted.

Recommendations For MediaWiki CheckUser extension versions through 1.34, update to a version that fixes this issue to prevent unauthorized access to sensitive information.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2019-18611

Affected Products

Mediawiki Checkuser Extension

References · 4

• https://gerrit.wikimedia.org/r/q/Ie0aa0df2b3f03d8b910733f1b5e600a0dc978765 · Vendor Advisory
• https://phabricator.wikimedia.org/T234862 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-18611 · Security Note
• https://osv.dev/vulnerability/CVE-2019-18611 · Vendor Advisory