CVE-2022-28202
- Source
- https://nvd.nist.gov/vuln/detail/CVE-2022-28202
- Import Source
- https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2022-28202.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/CVE-2022-28202
- Aliases
- Downstream
- Related
- Published
- 2022-03-30T06:15:06Z
- Modified
- 2025-07-01T13:53:03.016429Z
- Severity
-
- 6.1 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
- Summary
- [none]
- Details
-
An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.
- References
-
- https://phabricator.wikimedia.org/T297543
- https://security.gentoo.org/glsa/202305-24
- https://www.debian.org/security/2022/dsa-5246
- https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PT4CHJKOQOVMI65TSNZRNV6FIWU7SGZD/
- https://security-tracker.debian.org/tracker/CVE-2022-28202
Affected packages
Debian:11 / mediawiki
Package
- Name
- mediawiki
- Purl
- pkg:deb/debian/mediawiki?arch=source
Affected ranges
- Type
- ECOSYSTEM
- Events
-
Introduced0Unknown introduced version / All previous versions are affectedFixed1:1.35.8-1~deb11u1
Debian:12 / mediawiki
Package
- Name
- mediawiki
- Purl
- pkg:deb/debian/mediawiki?arch=source
Debian:13 / mediawiki
Package
- Name
- mediawiki
- Purl
- pkg:deb/debian/mediawiki?arch=source