PT-2020-9835 · Mediawiki · Mediawiki+1

Published 2020-03-19 · Updated 2020-03-24 · CVE-2019-16529

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki CheckUser extension versions through 1.35.0

Description An issue was discovered in the CheckUser extension for MediaWiki, where oversighted edit summaries are still visible in CheckUser results, violating MediaWiki's permissions model.

Recommendations For versions through 1.35.0, consider restricting access to CheckUser results to minimize the risk of exploitation until a patch is available.

Fix

Related Identifiers

CVE-2019-16529

Affected Products

Checkuser Extension

Mediawiki

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2019-16529 · Security Note
• https://osv.dev/vulnerability/CVE-2019-16529 · Vendor Advisory
• https://phabricator.wikimedia.org/rECHU22ddd638ba79903361df88c755232a532cbdbfb3 · Vendor Advisory
• https://phabricator.wikimedia.org/T207094 · Note
• https://t.me/cvenotify/1919 · Telegram Post