Main Vulnerability Database Vulnerabilities #VU62010

Permissions, Privileges, and Access Controls in MediaWiki - CVE-2022-28206

Published: April 8, 2022

Vulnerability identifier: #VU62010

CSH Severity: High

CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Amber

CVE-ID: CVE-2022-28206

CWE-ID: CWE-264

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vendor: MediaWiki.org

Affected software:
MediaWiki

Detailed vulnerability description

The vulnerability allows a remote attacker to escalate privileges on the system.

The vulnerability exists due to the FileImporter allows imports to cascade protected files when the importer does not have administrator permissions.

Install updates from vendor's website.