Permissions, Privileges, and Access Controls in MediaWiki - CVE-2022-28206
Published: April 8, 2022
Vulnerability identifier: #VU62010
CSH Severity: High
CVSS v4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2022-28206
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to escalate privileges on the system.
The vulnerability exists due to the FileImporter allows imports to cascade protected files when the importer does not have administrator permissions.
Affected software
MediaWiki
How to mitigate CVE-2022-28206
Install updates from vendor's website.
MediaWiki - addressed in versions 1.35.6, 1.36.4, 1.37.2