Unrated

An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes p...

CVE-2022-28202 First seen on SecPulse Mar 30, 2022

Fix status by distribution

Fixed packages published by each distribution for this CVE

Debian DEBIAN-CVE-2022-28202 mediawiki Fixed in: 1:1.35.8-1~deb11u1
Ubuntu UBUNTU-CVE-2022-28202 mediawiki

Original description The description as published by the source.

An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.

Source: OSV.dev (Open Source Vulnerabilities) NVD OSV

References

advisory github.com
advisory lists.fedoraproject.org
advisory nvd.nist.gov
advisory security.gentoo.org
advisory debian.org
web phabricator.wikimedia.org
web lists.debian.org

Key facts

Severity: Unrated
Published: Mar 30, 2022
First seen on SecPulse: Mar 30, 2022

NVD OSV

Detection sources

OSV.dev (Open Source Vulnerabilities)Oct 20, 19:55