CVE-2022-28201 — Uncontrolled Recursion in Mediawiki

CWE-674 — Uncontrolled Recursion4 documents4 sources
Severity
4.4MEDIUMNVD
EPSS
0.1%
top 79.34%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
MediawikiDebian MediawikiDebian Linux
Timeline
PublishedSep 19
Latest updateSep 20

Description

An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinite recursion, because a bare local interwiki is mishandled for the mainpage message.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:HExploitability: 0.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/mediawiki< mediawiki 1:1.35.6-1 (bookworm)
▶NVDmediawiki/mediawiki1.36.0 — 1.36.4+2
▶Debianmediawiki/mediawiki< 1:1.35.8-1~deb11u1+3

Also affects: Debian Linux 10.0, 11.0

Patches

Patch: phabricator.wikimedia.org ↗Patch: phabricator.wikimedia.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-3fgq-p3w2-7q9w: An issue was discovered in MediaWiki before 1↗2022-09-20
▶
OSV
CVE-2022-28201: An issue was discovered in MediaWiki before 1↗2022-09-19
▶

📋Vendor Advisories

1
Debian
CVE-2022-28201: mediawiki - An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1....↗2022
▶
CVE-2022-28201 — Uncontrolled Recursion in Mediawiki | cvebase