Circumvention of Title_blacklist Protection in MediaWiki Core
Summary
CVE-2019-19709: Possible to circumvent title-blacklist. Affects mediawiki/core across 4 version ranges.
>= 1.31.0, < 1.31.6
>= 1.32.0, < 1.32.6
>= 1.33.0, < 1.33.2
>= 1.33.99, < 1.34.0
Fixed in 4 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Also tracked for
- mediawiki · Debian:11
The same CVE-2019-19709 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
MediaWiki Core is an open-source software package that provides the foundation for the popular MediaWiki platform used by Wikipedia and other Wikimedia projects. It offers a range of features for creating and managing collaborative websites. However, a vulnerability has been discovered in versions 1.31.0 through 1.33.2 of MediaWiki Core that allows attackers to bypass the Title_blacklist protection mechanism.
Vulnerability Detail
The vulnerability in MediaWiki Core allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page. This circumvention technique allows attackers to create pages with titles that should be blocked by the Title_blacklist, potentially leading to unauthorized content creation or other malicious activities.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 1.31.0, < 1.31.61.31.6composer require mediawiki/core:1.31.6 -
>= 1.32.0, < 1.32.61.32.6composer require mediawiki/core:1.32.6 -
>= 1.33.0, < 1.33.21.33.2composer require mediawiki/core:1.33.2 -
>= 1.33.99, < 1.34.01.34.0composer require mediawiki/core:1.34.0
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the fix by upgrading to a fixed version of MediaWiki Core.
Conclusion
In conclusion, the vulnerability in MediaWiki Core that allows the circumvention of the Title_blacklist protection mechanism has been addressed in fixed versions of the software. It is recommended to upgrade to one of the fixed versions to ensure the security of your MediaWiki installation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for mediawiki/core →
FAQ
MediaWiki Core is an open-source software package that provides the foundation for collaborative websites, including Wikipedia.
The Title_blacklist protection mechanism in MediaWiki Core is designed to prevent the creation of pages with specific titles that are deemed inappropriate or potentially harmful.
An attacker can exploit this vulnerability by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.
The vulnerability allows attackers to bypass the Title_blacklist protection mechanism, potentially leading to unauthorized content creation or other malicious activities.
Yes, the vulnerability has been fixed in versions 1.31.6, 1.32.6, 1.33.2, and 1.34.0 of MediaWiki Core.
Related vulnerabilities
Recent vulnerabilities recorded for mediawiki/core.
