MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using redirect=1 in the action API when editing that page.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting     with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using     redirect=1 in the action API when editing that page. (CVE-2019-19709)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - MediaWiki through 1.33.1 allows attackers to bypass the Title_blacklist protection mechanism by starting
    with an arbitrary title, establishing a non-resolvable redirect for the associated page, and using
    redirect=1 in the action API when editing that page. (CVE-2019-19709)

It was discovered that the Title blacklist functionality in MediaWiki, a website engine for collaborative work, could by bypassed.

ID	Name	Product	Family	Type	Severity
248748	Linux Distros Unpatched Vulnerability : CVE-2019-19709	Nessus	Misc.	Local	medium
432990	SCA: security update for mediawiki/core (GHSA-pjv5-vv93-p648)	Tenable Cloud Security	SCA Checks	Local	medium
432990	SCA: security update for mediawiki/core (GHSA-pjv5-vv93-p648)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
132423	Debian DSA-4592-1 : mediawiki - security update	Nessus	Debian Local Security Checks	Local	medium

Detections

Analytics

CVE-2019-19709

medium

Tenable Plugins

medium

medium

medium

medium