Security readout for executives and security teams
Plain-English summary
This CVE affects MediaWiki sites using the VisualEditor extension through version 1.34. A user could paste specially formed content that triggers cross-site scripting. Business urgency is highest for public or broadly editable wikis where untrusted users can create or edit content.
Executive priority
Treat this as a targeted web application risk, not an infrastructure emergency. Prioritize public or community-editable wikis, then internal wikis with sensitive session or identity context.
Technical view
VisualEditor through 1.34 allows XSS through pasted content containing an element with a data-ve-clipboard-key attribute. The source bundle does not provide CVSS, CWE, fixed version, or detailed patch notes. The Gerrit reference indicates code review activity, but the provided evidence does not name a specific remediation release.
Likely exposure
Exposure is likely limited to MediaWiki deployments with VisualEditor enabled, especially versions through 1.34 and sites allowing untrusted or semi-trusted users to edit pages.
Exploitation context
The source bundle does not show active exploitation, and KEV is false. The plausible impact is browser-side script execution in the wiki context after malicious pasted content is saved or rendered.
Researcher notes
The public bundle is sparse: no CVSS, CWE, fixed version, or exploit evidence is provided. Analysis should stay anchored to VisualEditor pasted-content XSS and avoid assuming broader MediaWiki core exposure without vendor confirmation.
Mitigation direction
- Inventory MediaWiki sites using the VisualEditor extension.
- Identify VisualEditor and MediaWiki versions, prioritizing versions through 1.34.
- Check Wikimedia or MediaWiki guidance for the fixed release or patch.
- Update VisualEditor or MediaWiki according to vendor guidance.
- Limit editing rights for untrusted users until remediation is confirmed.
Validation and detection
- Confirm whether VisualEditor is installed and enabled on each wiki.
- Verify deployed versions are not within the affected range.
- Review vendor release notes or patches for CVE-2019-19708 coverage.
- Test paste sanitization in a controlled staging environment only.
- Review logs or page histories for suspicious edited content if exposure existed.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CVE-2019-19708 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Unknown
- CVSS
- Not scored
- Known Exploited
- No
- Published
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
CVSS and timeline data
No CVSS vectors or timeline events were available in the normalized CVE source material.
Source materials
- CVE List V5 sourceCVE List V5
- https://phabricator.wikimedia.org/T239209CVE reference · x_refsource_MISC
- https://gerrit.wikimedia.org/r/q/I1f99458fd2c4f6b2460dfe7a93b330ddee4400b6CVE reference · x_refsource_MISC
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.