CentralAuth Extension Vulnerability in MediaWiki by Wikimedia
CVE-2022-28205

9.8CRITICAL

Key Information:

Vendor

Mediawiki
Status
Mediawiki
Vendor
CVE Published:
30 March 2022

What is CVE-2022-28205?

A vulnerability has been identified in the CentralAuth extension of MediaWiki, which affects versions up to 1.37.1. This flaw relates to improper handling of the time-to-live (TTL) for user groups that are set to expire in the future, potentially allowing unauthorized access or elevated privileges for certain users. Organizations using this extension should review their configurations and apply necessary updates to mitigate potential risks.

References

https://gerrit.wikimedia.org/r/q/Ic6ba1a37b78df5b342ceeba...
https://phabricator.wikimedia.org/T302248
https://security.gentoo.org/glsa/202305-24
vendor-advisory

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.