CVE-2022-28201

MediumCVSS 4.4/10Last modified Jun 17, 2026

Description

An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinite recursion, because a bare local interwiki is mishandled for the mainpage message.

Metrics

CVSS 3.1 4.4/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-674

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

https://blog.legoktm.com/2022/07/03/a-belated-writeup-of-cve-2022-28201-in-mediawiki.htmlExploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00027.htmlMailing List, Third Party Advisory
https://phabricator.wikimedia.org/T297571Patch, Vendor Advisory
https://www.debian.org/security/2022/dsa-5246Third Party Advisory
https://blog.legoktm.com/2022/07/03/a-belated-writeup-of-cve-2022-28201-in-mediawiki.htmlExploit, Third Party Advisory
https://lists.debian.org/debian-lts-announce/2022/09/msg00027.htmlMailing List, Third Party Advisory
https://phabricator.wikimedia.org/T297571Patch, Vendor Advisory
https://www.debian.org/security/2022/dsa-5246Third Party Advisory

Timeline

Published: Sep 19, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-282026.1An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, an CVE-2022-282037.5A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, CVE-2022-282047.5A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere&target=Pr CVE-2022-282059.8An issue was discovered in MediaWiki through 1.37.1. The CentralAuth extension mishandles a ttl issue for groups expiring in the future.CVE-2022-282069.8An issue was discovered in MediaWiki through 1.37.1. ImportPlanValidator.php in the FileImporter extension mishandles the check for edit rig CVE-2022-282099.8An issue was discovered in Mediawiki through 1.37.1. The check for the override-antispoof permission in the AntiSpoof extension is incorrect CVE-2022-28217.5Missing Critical Step in Authentication in GitHub repository namelessmc/nameless prior to v2.0.2.CVE-2022-282138.1When a user access SOAP Web services in SAP BusinessObjects Business Intelligence Platform - version 420, 430, it does not sufficiently vali CVE-2022-282147.8During an update of SAP BusinessObjects Enterprise, Central Management Server (CMS) - versions 420, 430, authentication credentials are bein CVE-2022-282154.7SAP NetWeaver ABAP Server and ABAP Platform - versions 740, 750, 787, allows an unauthenticated attacker to redirect users to a malicious si CVE-2022-282166.1SAP BusinessObjects Business Intelligence Platform (BI Workspace) - version 420, is susceptible to a Cross-Site Scripting attack by an unaut CVE-2022-282176.5Some part of SAP NetWeaver (EP Web Page Composer) does not sufficiently validate an XML document accepted from an untrusted source, which al