CVE-2019-19709
Fixed in a distro release EPSS 2%
MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.
Products: mediawiki, debian_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Packagist | mediawiki/core | 1.31.6 |
| Packagist | mediawiki/core | 1.32.6 |
| Packagist | mediawiki/core | 1.33.2 |
| Packagist | mediawiki/core | 1.34.0 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 10 | mediawiki | 1:1.31.6-1~deb10u1 |
| Debian 12 | mediawiki | 1:1.31.6-1 |
| Debian 13 | mediawiki | 1:1.31.6-1 |
| Debian 14 | mediawiki | 1:1.31.6-1 |
| Debian 9 | mediawiki | 1:1.27.7-1~deb9u3 |
| Ubuntu 18.04 LTS | mediawiki | no fix |