PT-2022-18875 · Mediawiki+1 · Mediawiki+2

Dylsss · Published 2022-03-30 · Updated 2024-03-06 · CVE-2022-28206

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions MediaWiki versions through 1.37.1

Description An issue was discovered in the ImportPlanValidator.php file of the FileImporter extension, where it mishandles the check for edit rights.

Recommendations For MediaWiki versions through 1.37.1, consider disabling the FileImporter extension until a patch is available. Restrict access to the ImportPlanValidator.php file to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

ALT-PU-2022-2140

ALT-PU-2022-2428

BIT-MEDIAWIKI-2022-28206

CVE-2022-28206

Affected Products

Alt Linux

Fileimporter Extension

Mediawiki

References · 7

• 🔥 https://phabricator.wikimedia.org/T294256 · Exploit
• https://gerrit.wikimedia.org/r/q/I84be9cd3639b8ab0e037a4ec2d3f2f478f0989c5 · Patch
• https://security.gentoo.org/glsa/202305-24 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-28206 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-28206 · Security Note
• https://osv.dev/vulnerability/BIT-mediawiki-2022-28206 · Vendor Advisory
• https://t.me/cvenotify/50866 · Telegram Post