MediaWiki information disclosure

published 2019-09-26 7 y ago modified 2026-06-17 4 mo ago also GHSA-7hwr-f745-5rwq , EUVD-2022-3016

cvss: 5.3; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 1.8%; EPSS 1.8% chance of exploitation in 30 days, percentile 78%
public exploits: 0; none known

In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup.

Patch / fix

fixed in 2 distros 1 links 1

packagist mediawiki/core 1.31.4, 1.32.4, 1.33.1
mediawiki mediawiki 1.31.4, 1.32.4, 1.33.1

mediawiki Debian 14, Debian 13, Debian 12 1:1.31.4-1

debian advisories DEBIAN-CVE-2019-16738

phabricator.wikimedia.org/T230402 advisory

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2019-16738 updated 2026-04-15 cvss 4.3

mediawiki: suppressed username information disclosure via Special:Redirect

Red Hat OpenShift Container Platform 3.9 mediawiki123 Red Hat OpenShift Container Platform 3.10 mediawiki
affected: no fix planned “Out of support scope”
Red Hat OpenShift Container Platform 3.11 mediawiki Red Hat OpenShift Container Platform 4 mediawiki
affected: no fix planned “Will not fix”

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

1.77% chance of exploitation in the next 30 days, higher than 78% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

phabricator.wikimedia.org https://phabricator.wikimedia.org/T230402 referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
NVD	2.0	5.0	AV:N/AC:L/Au:N/C:P/I:N/A:N
GitHub	3.1	5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected packages

ecosystem	package	affected	fixed in
packagist	mediawiki/core	>=1.31.0, <1.31.4 >=1.32.0, <1.32.4 >=1.33.0, <1.33.1	1.31.4 1.32.4 1.33.1

Classification

Weakness

CWE-862 Missing Authorization
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

References

phabricator.wikimedia.org /T230402
web, exploit, issue-tracking, patch, third-party-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/7OMG3BMUHGWTAPYTK2NXM6CXF6FYLOUO/
vendor-advisory, broken-link
debian.org /security/2019/dsa-4545
vendor-advisory, web, third-party-advisory
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/QBAOLXETM5BOYQG6OQVHGB2LNLZUXVN6/
vendor-advisory, broken-link
seclists.org /bugtraq/2019/Oct/32
mailing-list, web, third-party-advisory
nvd.nist.gov /vuln/detail/CVE-2019-16738
advisory
github.com /FriendsOfPHP/security-advisories/blob/master/mediawiki/core/CVE-2019-16738.yaml
web
github.com /wikimedia/mediawiki
package
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/7OMG3BMUHGWTAPYTK2NXM6CXF6FYLOUO
web
lists.fedoraproject.org /archives/list/package-announce%40lists.fedoraproject.org/message/QBAOLXETM5BOYQG6OQVHGB2LNLZUXVN6
web
lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/7OMG3BMUHGWTAPYTK2NXM6CXF6FYLOUO
web
lists.fedoraproject.org /archives/list/package-announce@lists.fedoraproject.org/message/QBAOLXETM5BOYQG6OQVHGB2LNLZUXVN6
web

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary