CVE-2022-28203
A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1...
A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special:NewFiles with actor as a condition can result in a very long running query.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- High
Exploit likelihood
What each source reports
NVD Score used
A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special:NewFiles with actor as a condition can result in a very long running query.
- Record
CVE-2022-28203- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-763
- Updated
- 2026-11-02
CVE List No score
A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special:NewFiles with actor as a condition can result in a very long running query.
- Record
CVE-2022-28203- Updated
- 2026-11-02
EUVDEUVD-2022-32657 No score
A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special:NewFiles with actor as a condition can result in a very long running query.
- Record
EUVD-2022-32657- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-647g-vgr2-5gqc
A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1...
A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special:NewFiles with actor as a condition can result in a very long running query.
- Record
GHSA-647g-vgr2-5gqc- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Weakness
- CWE-763
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-28203
A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special:NewFiles with actor as a condition can result in a very long running query.
- Record
DEBIAN-CVE-2022-28203- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-03
OSVUBUNTU-CVE-2022-28203
A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special:NewFiles with actor as a condition can result in a very long running query.
- Record
UBUNTU-CVE-2022-28203- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVBIT-mediawiki-2022-28203 No score
A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special:NewFiles with actor as a condition can result in a very long running query.
- Record
BIT-mediawiki-2022-28203- Updated
- 2026-11-02
OSV No score
A denial-of-service issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. When many files exist, requesting Special:NewFiles with actor as a condition can result in a very long running query.
- Record
CVE-2022-28203- Updated
- 2026-11-02
OSVMGASA-2022-0145 No score
Updated mediawiki packages fix security vulnerability
Title::newMainPage() goes into an infinite recursion loop if it points to a local interwiki (CVE-2022-28201).
Messages widthheight/widthheightpage/nbytes not escaped when used in galleries or Special:RevisionDelete (CVE-2022-28202).
Requesting Special:NewFiles on a wiki with many file uploads with actor as a condition can result in a DoS (CVE-2022-28203).
Special:WhatLinksHere can result in a DoS when a page is used on a extremely large number of other pages (CVE-2022-28204).
- Record
MGASA-2022-0145- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiBitnami |
before 1.35.6, 1.36.0 up to 1.36.4, 1.37.0 up to 1.37.2 | 1.35.61.36.41.37.2 |
mediawikiDebian:12 |
before 1:1.35.6-1 | 1:1.35.6-1 |
mediawikiDebian:13 |
before 1:1.35.6-1 | 1:1.35.6-1 |
mediawikiDebian:14 |
before 1:1.35.6-1 | 1:1.35.6-1 |
mediawikiDebian:10 From an advisory covering 6 CVEs |
before 1:1.31.16-1+deb10u3, plus listed versions 1:1.31.10-1~deb10u11:1.31.12-1~deb10u11:1.31.14-1~deb10u11:1.31.16-1+deb10u21:1.31.16-1~deb10u1 Show 11 moreShow less1:1.31.2-11:1.31.4-11:1.31.4-1~deb10u11:1.31.5-11:1.31.5-21:1.31.5-31:1.31.6-11:1.31.6-1~deb10u11:1.31.7-11:1.31.7-1~deb10u11:1.31.8-1 |
1:1.31.16-1+deb10u3 |
mediawikiDebian:11 From an advisory covering 15 CVEs |
before 1:1.35.8-1~deb11u1, plus listed versions 1:1.35.2-11:1.35.3-11:1.35.4-11:1.35.4-1+deb11u21:1.35.4-1~deb11u1 Show 4 moreShow less1:1.35.5-11:1.35.5-21:1.35.6-11:1.35.7-1 |
1:1.35.8-1~deb11u1 |
mediawikiMageia:8 From an advisory covering 4 CVEs |
before 1.35.6-1.mga8 | 1.35.6-1.mga8 |
mediawikiUbuntu:18.04:LTS |
All versions, plus listed versions 1:1.27.3-11:1.27.4-11:1.27.4-21:1.27.4-3 |
None known |
mediawikiUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 1:1.31.2-1ubuntu11:1.31.5-11:1.31.5-1ubuntu11:1.31.5-21:1.31.5-3 Show 4 moreShow less1:1.31.5-3ubuntu11:1.31.6-11:1.31.7-11:1.31.7-1ubuntu0.1~esm1 |
None known |
mediawikiUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 1:1.35.3-11:1.35.4-11:1.35.5-11:1.35.5-1ubuntu11:1.35.5-1ubuntu21:1.35.5-1ubuntu31:1.35.6-11:1.35.6-1ubuntu0.1~esm1 |
None known |
Show 4 moreShow less
| Package | Affected | Fixed |
|---|---|---|
mediawikiUbuntu:Pro:24.04:LTS |
All versions, plus listed versions 1:1.39.4-21:1.39.5-11:1.39.6-11:1.39.7-11:1.39.7-1ubuntu0.1~esm1 |
None known |
mediawikiUbuntu:25.10 |
All versions, plus listed versions 1:1.43.1+dfsg-11:1.43.1+dfsg-21:1.43.3+dfsg-1 |
None known |
mediawikiUbuntu:26.10 |
All versions, plus listed versions 1:1.43.8+dfsg-21:1.43.9+dfsg-11:1.43.9+dfsg-1ubuntu1 |
None known |
mediawikiUbuntu:26.04:LTS |
All versions, plus listed versions 1:1.43.3+dfsg-11:1.43.5+dfsg-11:1.43.6+dfsg-21:1.43.8+dfsg-11:1.43.8+dfsg-2 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | OSV | |
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-28203 is a high vulnerability (CVSS 7.5) in Mediawiki, published April 18, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.47%, the 73rd percentile. Fixed in mediawiki 1.35.6.
References
phabricator.wikimedia.org/T297731
lists.debian.org/debian-lts-announce/2022/09/msg00027.html
debian.org/security/2022/dsa-5246
nvd.nist.gov/vuln/detail/CVE-2022-28203
github.com/advisories/GHSA-647g-vgr2-5gqc
Show 7 moreShow less
security-tracker.debian.org/tracker/CVE-2022-28203
advisories.mageia.org/MGASA-2022-0145.html
bugs.mageia.org/show_bug.cgi?id=30231
lists.wikimedia.org/hyperkitty/list/[email protected]/thread/YJNXKPV5Z56NSUQ4G3SXPDUIZG5EQ7UR
ubuntu.com/security/CVE-2022-28203
cve.org/CVERecord?id=CVE-2022-28203