CVE-2019-19709

MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.

• CWE-601

• https://gerrit.wikimedia.org/r/q/Ie54f366986056c876eade0fcad6c41f70b8b8de8Exploit, Vendor Advisory
• https://phabricator.wikimedia.org/T239466Exploit, Vendor Advisory
• https://seclists.org/bugtraq/2019/Dec/48Mailing List, Third Party Advisory
• https://www.debian.org/security/2019/dsa-4592Third Party Advisory
• https://gerrit.wikimedia.org/r/q/Ie54f366986056c876eade0fcad6c41f70b8b8de8Exploit, Vendor Advisory
• https://phabricator.wikimedia.org/T239466Exploit, Vendor Advisory
• https://seclists.org/bugtraq/2019/Dec/48Mailing List, Third Party Advisory
• https://www.debian.org/security/2019/dsa-4592Third Party Advisory

Published

Dec 11, 2019

Last Modified

Jun 17, 2026

Status

Modified

• One Click Account Takeover in GranolaHow a notification link broke out of Electron and led to a one-click account takeover.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2019-19702The modoboa-dmarc plugin 1.1.0 for Modoboa is vulnerable to …7.5
• CVE-2019-19703In Ktor through 1.2.6, the client resends data from the HTTP…6.1
• CVE-2019-19704In JetBrains Upsource before 2020.1, information disclosure …7.5
• CVE-2019-19705Realtek Audio Drivers for Windows, as used on the Lenovo Thi…7.8
• CVE-2019-19707On Moxa EDS-G508E, EDS-G512E, and EDS-G516E devices (with fi…7.5
• CVE-2019-19708The VisualEditor extension through 1.34 for MediaWiki allows…6.1
• CVE-2019-1971A vulnerability in the web portal of Cisco Enterprise NFV In…9.8
• CVE-2019-19712Contao 4.0 through 4.8.5 has Insecure Permissions. Back end …5.3
• CVE-2019-19714Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of …5.3
• CVE-2019-19719Tableau Server 10.3 through 2019.4 on Windows and Linux allo…6.1
• CVE-2019-1972A vulnerability the Cisco Enterprise NFV Infrastructure Soft…6.7
• CVE-2019-19720Yabasic 2.86.1 has a heap-based buffer overflow in the yylex…8.8