GitHub Advisoryadvisory · Packagist

GHSA-pjv5-vv93-p648 Possible to circumvent title-blacklist

MEDIUM Published 2022-05-24 Modified 2024-05-15 Official page ↗
Aliases
CVE-2019-19709
Ecosystem
Packagist
Packages
mediawiki/core
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weaknesses
CWE-601
Reviewed
2024-05-15

Affected packages

• Packagist mediawiki/core: >= 1.31.0, < 1.31.6 → fixed in 1.31.6 • Packagist mediawiki/core: >= 1.32.0, < 1.32.6 → fixed in 1.32.6 • Packagist mediawiki/core: >= 1.33.0, < 1.33.2 → fixed in 1.33.2 • Packagist mediawiki/core: >= 1.33.99, < 1.34.0 → fixed in 1.34.0

Description

MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.

Related

Alias · CVE (1)

  • CVE-2019-19709 MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title,… vulnerability

Weakness · CWE (1)

  • CWE-601 URL Redirection to Untrusted Site weakness

References