Medium severity · published Oct 29, 2019
CVE-2019-18611
An issue was discovered in the CheckUser extension through 1.34 for MediaWiki
6.5
CVSS
0.9%
EPSS
No
On KEV
Description
An issue was discovered in the CheckUser extension through 1.34 for MediaWiki. Certain sensitive information within oversighted edit summaries made available via the MediaWiki API was potentially visible to users with various levels of access to this extension. Said users should not have been able to view these oversighted edit summaries via the MediaWiki API.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
Attack vector
Network
Complexity
Low
Privileges
Low
User interaction
None
Confidentiality
High
Integrity
None
Availability
None
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)0.9% · higher than 60% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
CH
Checkuser · Mediawiki
through 1.34 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-18611
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-18611
Patch
https://gerrit.wikimedia.org/r/q/Ie0aa0df2b3f03d8b910733f1b5e600a0dc978765
Patch
https://phabricator.wikimedia.org/T234862
More from Checkuser
8.8
CVE-2025-67478
Wrong E-Mail address composition for usernames with a comma and Umlauts in it like "Döe, Jähn"
7.5
CVE-2026-34090
Suggested investigations: Handle suppressed usernames
6.1
CVE-2025-61651
i18n XSS through Special:CheckUser CheckUser helper
6.1
CVE-2025-61648
Stored XSS through system messages in CheckUser
5.3
CVE-2019-16529
An issue was discovered in the CheckUser extension through 1.35.0 for MediaWiki