MediaWiki Title Blacklist Bypass Vulnerability (CVE-2019-19709)
Summary
CVE-2019-19709: MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in th... Affects mediawiki across 2 version ranges.
< 1:1.31.6-1
< 573f48150317f0153d90542d139621460a7638a5
Fixed in 1:1.31.6-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
MediaWiki is a free and open-source wiki software platform used to power collaborative websites, including Wikipedia. It provides a robust framework for creating and managing content, featuring user management, version control, and extensive customization options. However, certain versions of MediaWiki are vulnerable to a specific issue that allows attackers to bypass the Title_blacklist protection mechanism, potentially leading to unauthorized content creation.
Vulnerability Detail
The vulnerability, identified as CVE-2019-19709, exists in MediaWiki versions up to 1.33.1. It allows attackers to exploit the Title_blacklist feature by starting with an arbitrary title, creating a non-resolvable redirect for the associated page, and then using the 'redirect=1' parameter in the action API when editing that page. This can lead to the creation of pages that should have been blocked by the Title_blacklist, posing a risk of unauthorized content being published on the platform.
How To Fix
Minimum fixed version
1:1.31.6-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade mediawikiTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, administrators can manually review and restrict page titles that may be exploited until the software is updated. Additionally, disabling the action API for editing may help mitigate the risk until a patch is applied.
Conclusion
CVE-2019-19709 is a significant vulnerability in MediaWiki that allows for the bypassing of the Title_blacklist protection. It is crucial for users of affected versions to update their installations to prevent unauthorized content creation. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for mediawiki →
FAQ
CVE-2019-19709 is a vulnerability in MediaWiki that allows attackers to bypass the Title_blacklist protection mechanism.
MediaWiki versions up to 1.33.1 are affected by this vulnerability.
Exploitation of this vulnerability could lead to unauthorized content creation on MediaWiki-powered sites.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score for CVE-2019-19709 is 6.1, indicating a medium level of severity.
References
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
