CVEvulnerability
CVE-2022-28202
6.1 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2022-03-30
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 ([email protected])
- 6.1 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:P/A:N
- Weaknesses
- CWE-79
Description
An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.
Affected configurations
• mediawiki mediawiki (< 1.35.6)
• mediawiki mediawiki (>= 1.36.0 < 1.36.4)
• mediawiki mediawiki (>= 1.37.0 < 1.37.2)
• fedoraproject fedora 36
• debian debian linux 10.0
Related
Weakness · CWE (1)
- CWE-79 Improper Neutralization of Input During Web Page Generation weakness
References
- https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PT4CHJKOQOVMI65TSNZRNV6FIWU7SGZD/ lists.fedoraproject.org
- https://phabricator.wikimedia.org/T297543 Issue Tracking, Patch, Vendor Advisory
- https://security.gentoo.org/glsa/202305-24 security.gentoo.org
- https://www.debian.org/security/2022/dsa-5246 Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html Mailing List, Third Party Advisory
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PT4CHJKOQOVMI65TSNZRNV6FIWU7SGZD/ lists.fedoraproject.org
- https://phabricator.wikimedia.org/T297543 Issue Tracking, Patch, Vendor Advisory
- https://security.gentoo.org/glsa/202305-24 security.gentoo.org
- https://www.debian.org/security/2022/dsa-5246 Third Party Advisory