Main Vulnerability Database Vulnerabilities #VU62010

#VU62010 Permissions, Privileges, and Access Controls in MediaWiki - CVE-2022-28206

Published: April 8, 2022

Vulnerability identifier: #VU62010

Vulnerability risk: High

CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2022-28206

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerable software:
MediaWiki

Software vendor:
MediaWiki.org

Description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to the FileImporter allows imports to cascade protected files when the importer does not have administrator permissions.

Install updates from vendor's website.