CVSS: 4.4EPSS: 0%CPEs: 5EXPL: 1CVE-2022-28201
https://notcve.org/view.php?id=CVE-2022-28201
An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinite recursion, because a bare local interwiki is mishandled for the mainpage message. Se ha detectado un problema en MediaWiki versiones anteriores a 1.35.6, 1.36.x anteriores a 1.36.4 y 1.37.x anteriores a 1.37.2. Los usuarios con el permiso editinterface pueden desencadenar una recursión infinita, porque un interwiki local desnudo es manejado inapropiadamente para el mensaje de la página principal • https://blog.legoktm.com/2022/07/03/a-belated-writeup-of-cve-2022-28201-in-mediawiki.html https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html https://phabricator.wikimedia.org/T297571 https://www.debian.org/security/2022/dsa-5246 • CWE-674: Uncontrolled Recursion •
CVSS: 4.9EPSS: 0%CPEs: 1EXPL: 1CVE-2022-39194
https://notcve.org/view.php?id=CVE-2022-39194
An issue was discovered in the MediaWiki through 1.38.2. The community configuration pages for the GrowthExperiments extension could cause a site to become unavailable due to insufficient validation when certain actions (including page moves) were performed. Se ha detectado un problema en MediaWiki versiones hasta 1.38.2. Las páginas de configuración de la comunidad para la extensión GrowthExperiments podían causar que un sitio no estuviera disponible debido a una comprobación insuficiente cuando son llevados a cabo determinadas acciones (incluyendo movimientos de página) • https://phabricator.wikimedia.org/T313205 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.1EPSS: 0%CPEs: 7EXPL: 0CVE-2022-34911
https://notcve.org/view.php?id=CVE-2022-34911
An issue was discovered in MediaWiki before 1.35.7, 1.36.x and 1.37.x before 1.37.3, and 1.38.x before 1.38.1. XSS can occur in configurations that allow a JavaScript payload in a username. After account creation, when it sets the page title to "Welcome" followed by the username, the username is not escaped: SpecialCreateAccount::successfulAction() calls ::showSuccessPage() with a message as second parameter, and OutputPage::setPageTitle() uses text(). Se ha detectado un problema en MediaWiki versiones anteriores a 1.35.7, 1.36.x y 1.37.x anteriores a 1.37.3, y 1.38.x anteriores a 1.38.1. Un ataque de tipo XSS puede ocurrir en configuraciones que permiten una carga útil de JavaScript en un nombre de usuario. • https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7N5ZBWLNNPZKFK7Q4KEHGCJ2YELQEUJP https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKKOQXPYLMBSEVDHFS32BPBR3ZQJKY5B https://phabricator.wikimedia.org/T308471 https://security.gentoo.org/glsa/202305-24 https://www.debian.org/security/2022/dsa-5246 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 6EXPL: 0CVE-2022-34912
https://notcve.org/view.php?id=CVE-2022-34912
An issue was discovered in MediaWiki before 1.37.3 and 1.38.x before 1.38.1. The contributions-title, used on Special:Contributions, is used as page title without escaping. Hence, in a non-default configuration where a username contains HTML entities, it won't be escaped. Se ha descubierto un problema en MediaWiki versiones anteriores a 1.37.3 y en versiones 1.38.x anteriores a 1.38.1. El contributions-title, usa en Special:Contributions, es usadao como título de la página sin escapar. • https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/7N5ZBWLNNPZKFK7Q4KEHGCJ2YELQEUJP https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DKKOQXPYLMBSEVDHFS32BPBR3ZQJKY5B https://phabricator.wikimedia.org/T308473 https://security.gentoo.org/glsa/202305-24 https://www.debian.org/security/2022/dsa-5246 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2022-34750
https://notcve.org/view.php?id=CVE-2022-34750
An issue was discovered in MediaWiki through 1.38.1. The lemma length of a Wikibase lexeme is currently capped at a thousand characters. Unfortunately, this length is not validated, allowing much larger lexemes to be created, which introduces various denial-of-service attack vectors within the Wikibase and WikibaseLexeme extensions. This is related to Special:NewLexeme and Special:NewProperty. Se ha detectado un problema en MediaWiki versiones hasta 1.38.1. • https://gerrit.wikimedia.org/r/q/I8171bfef73e525d73efa60b407ce147130ea4742 https://gerrit.wikimedia.org/r/q/Id89a9b08e40f075d2d422cafd03668dff3ce7fc9 https://phabricator.wikimedia.org/T308659 • CWE-770: Allocation of Resources Without Limits or Throttling •