CVE-2019-16529 json
An issue was discovered in the CheckUser extension through 1.35.0 for MediaWiki.
published 2020-03-19 6 y ago modified 2026-06-17 4 mo ago also EUVD-2019-7204
- cvss
- 5.3
- version 3.1, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.9%
- EPSS 0.9% chance of exploitation in 30 days, percentile 59%
- public exploits
- 0
- none known
Summary
An issue was discovered in the CheckUser extension through 1.35.0 for MediaWiki. Oversighted edit summaries are still visible in CheckUser results in violation of MediaWiki's permissions model.
Patch / fix
Exploit prediction
0.87% chance of exploitation in the next 30 days, higher than 59% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 3.1 | 5.3 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N |
| NVD | 2.0 | 5.0 | AV:N/AC:L/Au:N/C:P/I:N/A:N |
References
-
phabricator.wikimedia.org
/rECHU22ddd638ba79903361df88c755232a532cbdbfb3
patch, vendor-advisory
-
phabricator.wikimedia.org
/T207094
permissions-required
Sources
- CVE List CVE-2019-16529
- NVD CVE-2019-16529
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.