Denial-of-Service Vulnerability in MediaWiki by Wikimedia
CVE-2022-28204

7.5HIGH

Key Information:

Vendor

Mediawiki
Status
Mediawiki
Vendor
CVE Published:
19 September 2022

What is CVE-2022-28204?

A denial-of-service vulnerability was discovered in MediaWiki versions prior to 1.37.2, specifically affecting how the application processes certain requests. An attacker can exploit this vulnerability by sending crafted requests to the endpoint w/index.php?title=Special%3AWhatLinksHere&target=Property%3AP31&namespace=1&invert=1, potentially causing the server to hang for over thirty seconds. This prolonged processing time can lead to significant performance degradation and poses a risk of distributed denial-of-service (DDoS) attacks, impacting the availability of the service.

References

https://phabricator.wikimedia.org/T297754
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.