Improper User Permission Checks in MediaWiki CreateRedirect Extension
CVE-2022-29547

7.5HIGH

Key Information:

Vendor

Mediawiki
Status
Createredirect
Vendor
CVE Published:
21 April 2022

What is CVE-2022-29547?

The CreateRedirect extension of MediaWiki prior to April 14, 2022, contains a security flaw that fails to adequately verify user permissions for editing target pages. This oversight could allow unauthorized individuals, including those without proper access rights, to modify pages they should not be able to edit, leading to potential misinformation and abuse of the platform.

References

https://phabricator.wikimedia.org/T306174
x_refsource_MISC
https://phabricator.miraheze.org/T9061
x_refsource_MISC
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Cre...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.