CVE-2022-47927 — Incorrect Permission Assignment in Mediawiki

CWE-732 — Incorrect Permission Assignment5 documents5 sources
Severity
5.5MEDIUMNVD
EPSS
0.1%
top 83.75%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
MediawikiDebian MediawikiFedoraproject Fedora
Timeline
PublishedJan 12

Description

An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before 1.38.5, and 1.39.x before 1.39.1. When installing with a pre-existing data directory that has weak permissions, the SQLite files are created with file mode 0644, i.e., world readable to local users. These files include credentials data.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/mediawiki< mediawiki 1:1.39.1-1 (bookworm)
▶NVDmediawiki/mediawiki1.36.0 — 1.38.5+2
▶Debianmediawiki/mediawiki< 1:1.35.11-1~deb11u1+3

Also affects: Fedora 37

Patches

Patch: phabricator.wikimedia.org ↗Patch: phabricator.wikimedia.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-wv3p-jvhj-v4jc: An issue was discovered in MediaWiki before 1↗2023-01-12
▶
OSV
CVE-2022-47927: An issue was discovered in MediaWiki before 1↗2023-01-12
▶

📋Vendor Advisories

2
Red Hat
mediawiki: sqlite information leak↗2023-01-12
▶
Debian
CVE-2022-47927: mediawiki - An issue was discovered in MediaWiki before 1.35.9, 1.36.x through 1.38.x before...↗2022
▶
CVE-2022-47927 — Incorrect Permission Assignment | cvebase