CVE-2022-28202

medium

Description

An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.

References

Advisories
More

https://www.debian.org/security/2022/dsa-5246

https://security.gentoo.org/glsa/202305-24

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PT4CHJKOQOVMI65TSNZRNV6FIWU7SGZD/

https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html

https://phabricator.wikimedia.org/T297543

Details

Source: Mitre, NVD

Published: 2022-03-30

Updated: 2024-11-21

Risk Information

CVSS v2

Base Score: 4.3

Vector: CVSS2#AV:N/AC:M/Au:N/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N