CVE-2019-16738
MEDIUMCVSS 5.3/10EPSS 1.77%
Last modified
CVE-2019-16738 is a medium-severity vulnerability rated 5.3/10 on the CVSS scale. In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup.. EPSS estimates a 1.77% chance of exploitation in the next 30 days.
Description
In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Mediawiki | Mediawiki | >= 1.31.0, < 1.31.4 |
| Mediawiki | Mediawiki | >= 1.32.0, < 1.32.4 |
| Mediawiki | Mediawiki | >= 1.33.0, < 1.33.1 |
| Fedoraproject | Fedora | 30 |
| Fedoraproject | Fedora | 31 |
| Debian | Debian Linux | 9.0 |
| Debian | Debian Linux | 10.0 |
References
- https://phabricator.wikimedia.org/T230402Exploit, Issue Tracking, Patch, Third Party Advisory
- https://seclists.org/bugtraq/2019/Oct/32Mailing List, Third Party Advisory
- https://www.debian.org/security/2019/dsa-4545Third Party Advisory
- https://phabricator.wikimedia.org/T230402Exploit, Issue Tracking, Patch, Third Party Advisory
- https://seclists.org/bugtraq/2019/Oct/32Mailing List, Third Party Advisory
- https://www.debian.org/security/2019/dsa-4545Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Analyzed
Frequently Asked Questions
What is CVE-2019-16738?
In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup.
How severe is CVE-2019-16738?
CVE-2019-16738 has a CVSS score of 5.3/10 (MEDIUM severity). The EPSS model estimates a 1.77% probability of exploitation in the next 30 days.
How do I fix CVE-2019-16738?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- Uncovering a hidden BOLA in Appsmith's snapshot logicStrix autonomously discovered a BOLA/IDOR vulnerability in Appsmith's snapshot deletion path.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-16732Unencrypted HTTP communications for firmware upgrades in Pet…8.1
- CVE-2019-16733processCommandSetUid() in libcommon.so in Petwant PF-103 fir…9.8
- CVE-2019-16734Use of default credentials for the TELNET server in Petwant …9.8
- CVE-2019-16735A stack-based buffer overflow in processCommandUploadLog in …9.8
- CVE-2019-16736A stack-based buffer overflow in processCommandUploadSnapsho…9.8
- CVE-2019-16737The processCommandSetMac() function of libcommon.so in Petwa…9.8
- CVE-2019-1674A vulnerability in the update service of Cisco Webex Meeting…7.8
- CVE-2019-16743eBrigade before 5.0 has evenement_ical.php evenement SQL Inj…8.8
- CVE-2019-16744eBrigade before 5.0 has evenements.php cid SQL Injection.8.8
- CVE-2019-16745eBrigade before 5.0 has evenement_choice.php chxCal SQL Inje…8.8
- CVE-2019-16746An issue was discovered in net/wireless/nl80211.c in the Lin…9.8
- CVE-2019-16747In MatrixSSL before 4.2.2 Open, the DTLS server can encounte…7.5
Are you affected by CVE-2019-16738?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST