Fluid Attacks Database

Description

MediaWiki information disclosure In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Package	Affected version	Patched versions
debian 13	mediawiki	>=0 <1:1.31.4-1	1:1.31.4-1
debian 12	mediawiki	>=0 <1:1.31.4-1	1:1.31.4-1
packagist	mediawiki/core	>=1.31.0 <1.31.4 \|\| >=1.32.0 <1.32.4 \|\| >=1.33.0 <1.33.1	1.31.4, 1.32.4, 1.33.1
debian 14	mediawiki	>=0 <1:1.31.4-1	1:1.31.4-1
debian 11	mediawiki	>=0 <1:1.31.4-1	1:1.31.4-1

Aliases

1. CVE-2019-167382. NVD-2019-167383. OSV-DEBIAN-2019-167384. OSV-2019-167385. GCVE-2019-167386. SECURITY-TRACKER-CVE-2019-16738

References

1. https://github.com/FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2019-16738.yaml2. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OMG3BMUHGWTAPYTK2NXM6CXF6FYLOUO3. https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QBAOLXETM5BOYQG6OQVHGB2LNLZUXVN64. https://lists.fedoraproject.org/archives/list/[email protected]/message/7OMG3BMUHGWTAPYTK2NXM6CXF6FYLOUO5. https://lists.fedoraproject.org/archives/list/[email protected]/message/QBAOLXETM5BOYQG6OQVHGB2LNLZUXVN66. https://phabricator.wikimedia.org/T2304027. https://seclists.org/bugtraq/2019/Oct/328. https://www.debian.org/security/2019/dsa-4545

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.