Denial-of-Service Vulnerability in MediaWiki by Wikimedia
CVE-2022-28203

7.5HIGH

Key Information:

Vendor

Mediawiki
Status
Mediawiki
Vendor
CVE Published:
19 September 2022

What is CVE-2022-28203?

A denial-of-service vulnerability exists in MediaWiki that affects versions prior to 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. This vulnerability can be exploited by making requests to Special:NewFiles with actor conditions when many files are present, leading to excessively long-running database queries that can degrade the performance of the application.

References

https://phabricator.wikimedia.org/T297731
https://lists.debian.org/debian-lts-announce/2022/09/msg0...
mailing-list
https://www.debian.org/security/2022/dsa-5246
vendor-advisory

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.