CVE-2019-19709

MediumCVSS 6.1/10Last modified Jun 17, 2026

Description

MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.

Metrics

CVSS 3.1 6.1/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Weakness enumeration

CWE-601

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://gerrit.wikimedia.org/r/q/Ie54f366986056c876eade0fcad6c41f70b8b8de8Exploit, Vendor Advisory
https://phabricator.wikimedia.org/T239466Exploit, Vendor Advisory
https://seclists.org/bugtraq/2019/Dec/48Mailing List, Third Party Advisory
https://www.debian.org/security/2019/dsa-4592Third Party Advisory
https://gerrit.wikimedia.org/r/q/Ie54f366986056c876eade0fcad6c41f70b8b8de8Exploit, Vendor Advisory
https://phabricator.wikimedia.org/T239466Exploit, Vendor Advisory
https://seclists.org/bugtraq/2019/Dec/48Mailing List, Third Party Advisory
https://www.debian.org/security/2019/dsa-4592Third Party Advisory

Timeline

Published: Dec 11, 2019
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2019

CVE-2019-19719.8A vulnerability in the web portal of Cisco Enterprise NFV Infrastructure Software (NFVIS) could allow an unauthenticated, remote attacker to CVE-2019-197125.3Contao 4.0 through 4.8.5 has Insecure Permissions. Back end users can manipulate the details view URL to show pages and articles that have n CVE-2019-197145.3Contao 4.8.4 and 4.8.5 has Improper Encoding or Escaping of Output. It is possible to inject insert tags into the login module which will be CVE-2019-197196.1Tableau Server 10.3 through 2019.4 on Windows and Linux allows XSS via the embeddedAuthRedirect page.CVE-2019-19726.7A vulnerability the Cisco Enterprise NFV Infrastructure Software (NFVIS) restricted CLI could allow an authenticated, local attacker with va CVE-2019-197208.8Yabasic 2.86.1 has a heap-based buffer overflow in the yylex() function in flex.c via a crafted BASIC source file.CVE-2019-197217.8An off-by-one error in the DecodeBlock function in codec/sdl_image.c in VideoLAN VLC media player before 3.0.9 allows remote attackers to ca CVE-2019-197225.3In Dovecot before 2.3.9.2, an attacker can crash a push-notification driver with a crafted email when push notifications are used, because o CVE-2019-197247.5Insecure permissions (777) are set on $HOME/.singularity when it is newly created by Singularity (version from 3.3.0 to 3.5.1), which could CVE-2019-197259.8sysstat through 12.2.0 has a double free in check_file_actlst in sa_common.c.CVE-2019-197267.8OpenBSD through 6.6 allows local users to escalate to root because a check for LD_LIBRARY_PATH in setuid programs can be defeated by setting CVE-2019-197275.5SchedMD Slurm before 18.08.9 and 19.x before 19.05.5 has weak slurmdbd.conf permissions.