Access Control Violation in MediaWiki CheckUser Extension by Wikimedia
CVE-2019-16529

5.3MEDIUM

Key Information:

Vendor

Mediawiki
Status
Checkuser
Vendor
CVE Published:
19 March 2020

What is CVE-2019-16529?

An oversight in the CheckUser extension for MediaWiki versions up to 1.35.0 allows unauthorized visibility of edit summaries in CheckUser results. This flaw compromises the permissions model established by MediaWiki, potentially exposing sensitive user activity to those who should not have access.

References

https://phabricator.wikimedia.org/T207094
x_refsource_MISC
https://phabricator.wikimedia.org/rECHU22ddd638ba79903361...
x_refsource_CONFIRM

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
Low
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.