CVE-2022-28203 — Release of Invalid Pointer or Reference in Mediawiki

CWE-763 — Release of Invalid Pointer or Reference4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.4%
top 38.17%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
MediawikiDebian MediawikiDebian Linux
Timeline
PublishedSep 19
Latest updateSep 20

Description

A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special:NewFiles with actor as a condition can result in a very long running query.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/mediawiki< mediawiki 1:1.35.6-1 (bookworm)
▶NVDmediawiki/mediawiki1.36.0 — 1.36.4+2
▶Debianmediawiki/mediawiki< 1:1.35.8-1~deb11u1+3

Also affects: Debian Linux 10.0, 11.0

Patches

Patch: phabricator.wikimedia.org ↗Patch: phabricator.wikimedia.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-647g-vgr2-5gqc: A denial-of-service issue was discovered in MediaWiki before 1↗2022-09-20
▶
OSV
CVE-2022-28203: A denial-of-service issue was discovered in MediaWiki before 1↗2022-09-19
▶

📋Vendor Advisories

1
Debian
CVE-2022-28203: mediawiki - A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x befo...↗2022
▶
CVE-2022-28203 — Mediawiki vulnerability | cvebase