CVE-2019-16738

Published: Sep 26, 2019Modified: Apr 15, 2026

5.3

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: NVD

Description

In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup.

Affected (7)

Products: Mediawiki: Mediawiki · Fedoraproject: Fedora · Debian: Debian Linux

1 product

1 product

1 product

Configuration A

3 vulnerable

Vulnerable Software	Affected Versions
Mediawiki Mediawiki	From 1.31.0 to 1.31.4
Mediawiki Mediawiki	From 1.32.0 to 1.32.4
Mediawiki Mediawiki	From 1.33.0 to 1.33.1

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 30
Fedoraproject Fedora	Version 31

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 10.0
Debian Debian Linux	Version 9.0

Related CWEs

CWE-862

Missing Authorization

The product does not perform an authorization check when an actor attempts to access a resource or perform an action.

References (10)

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OMG3BMUHGWTAPYTK2NXM6CXF6FYLOUO/

Source: cve@mitre.org

Broken Link

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QBAOLXETM5BOYQG6OQVHGB2LNLZUXVN6/

Source: cve@mitre.org

Broken Link

https://phabricator.wikimedia.org/T230402

Source: cve@mitre.org

ExploitIssue TrackingPatchThird Party Advisory

https://seclists.org/bugtraq/2019/Oct/32

Source: cve@mitre.org

Mailing ListThird Party Advisory

https://www.debian.org/security/2019/dsa-4545

Source: cve@mitre.org

Third Party Advisory

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7OMG3BMUHGWTAPYTK2NXM6CXF6FYLOUO/