LiveActive security incident?Get immediate response
CVE Record

CVE-2019-16738: In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a U...

In MediaWiki through 1.33.0, Special:Redirect allows information disclosure of suppressed usernames via a User ID Lookup.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysismoderate

Security readout for executives and security teams

Plain-English summary

CVE-2019-16738 is an information disclosure issue in MediaWiki through 1.33.0. A Special:Redirect user ID lookup could reveal suppressed usernames, undermining privacy protections used for hidden or sensitive accounts. The business risk is mainly confidentiality, user safety, and trust, not system takeover.

Executive priority

Treat this as a targeted confidentiality issue. It is not described as system compromise, but it can expose identities that administrators deliberately suppressed. Prioritize patching on public wikis, sensitive community sites, and environments with legal, safety, or harassment concerns.

Technical view

The CVE describes Special:Redirect exposing suppressed usernames through User ID Lookup in MediaWiki through 1.33.0. Public advisories from Debian and Fedora indicate security updates were issued for packaged MediaWiki. The supplied sources do not provide CVSS, CWE, detailed exploit conditions, or evidence of active exploitation.

Likely exposure

Exposure is most likely for public or internal MediaWiki installations running versions through 1.33.0, especially sites using suppression or oversight workflows to hide sensitive usernames. Distribution-managed deployments should be checked against Debian and Fedora advisories where applicable.

Exploitation context

The source bundle does not show CISA KEV listing or cited evidence of active exploitation. The issue appears remotely relevant to users who can access the affected redirect lookup behavior, but the provided sources do not define authentication requirements or prevalence.

Researcher notes

Evidence is sparse in the CVE bundle: no CVSS, CWE, exploit status, or detailed affected package matrix is provided. Focus analysis on MediaWiki Special:Redirect and User ID Lookup behavior, patched package versions, and whether suppressed usernames can be inferred after remediation.

Mitigation direction

  • Upgrade MediaWiki according to upstream or distribution security guidance.
  • Apply Debian or Fedora MediaWiki security updates if using those packages.
  • Check vendor guidance for temporary controls if immediate patching is delayed.
  • Review suppressed-user privacy processes after remediation.

Validation and detection

  • Inventory all MediaWiki instances and record exact versions.
  • Confirm no instance runs MediaWiki through 1.33.0 without a vendor fix.
  • Verify Debian or Fedora package advisory status on managed hosts.
  • Perform a privacy-focused regression check for suppressed username disclosure.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cve · low confidence lookup

CVE-2019-16738 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
6Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
n/an/an/aListed
Weakness

CWE details

No CWE listed

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.