SQL Injection Vulnerability in SemanticDrilldown Extension for MediaWiki
CVE-2022-29904

9.8CRITICAL

Key Information:

Vendor

Mediawiki
Status
Mediawiki
Vendor
CVE Published:
29 April 2022

What is CVE-2022-29904?

The SemanticDrilldown extension in MediaWiki, prior to version 1.37.2, contains a vulnerability that allows attackers to exploit SQL injection through specific input characters such as '-' and '_'. This flaw can potentially enable unauthorized access to the database, leading to sensitive data exposure and manipulation. Users of MediaWiki are advised to update to the latest version to mitigate this risk.

References

https://phabricator.wikimedia.org/T306463
x_refsource_MISC
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Sem...
x_refsource_MISC

EPSS Score

16% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
9.8
Severity:
CRITICAL
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.