medium4.4
CVE-2022-28201
An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2.
Impact
An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinite recursion, because a bare local interwiki is mishandled for the mainpage message.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mediawiki | Mediawiki | before 1.35.6 from 1.36.0 before 1.36.4 from 1.37.0 before 1.37.2 |
| Debian | Debian Linux | Versions 10.0, 11.0 |
Weakness classification
References
- NVD record
- CVE.org record
- https://blog.legoktm.com/2022/07/03/a-belated-writeup-of-cve-2022-28201-in-mediawiki.html
- https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html
- https://phabricator.wikimedia.org/T297571
- https://www.debian.org/security/2022/dsa-5246
- https://blog.legoktm.com/2022/07/03/a-belated-writeup-of-cve-2022-28201-in-mediawiki.html
- https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html
- https://phabricator.wikimedia.org/T297571
- https://www.debian.org/security/2022/dsa-5246