{"id":"CVE-2022-28202","aliases":["BIT-mediawiki-2022-28202","DEBIAN-CVE-2022-28202","DLA-3117-1","DSA-5246-1","EUVD-2022-32656","GHSA-5c63-m98j-vx6v","MGASA-2022-0145","UBUNTU-CVE-2022-28202"],"status":"published","title":"An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1...","description":"An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01198,"percentile":0.6836,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2022-03-30T00:00:00Z","modified":"2026-11-03T08:01:11Z","fixes":[{"ecosystem":"Bitnami","package":"mediawiki","fixed_in":["1.35.6","1.36.4","1.37.2"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.35.6-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.35.6-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.35.6-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"mediawiki","ranges":[{"type":"SEMVER","events":[{"introduced":"0"},{"fixed":"1.35.6"},{"introduced":"1.36.0"},{"fixed":"1.36.4"},{"introduced":"1.37.0"},{"fixed":"1.37.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.6-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.6-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.6-1"}]}]},{"source":"osv","ecosystem":"Debian:10","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.31.16-1+deb10u3"}]}],"versions":["1:1.31.10-1~deb10u1","1:1.31.12-1~deb10u1","1:1.31.14-1~deb10u1","1:1.31.16-1+deb10u2","1:1.31.16-1~deb10u1","1:1.31.2-1","1:1.31.4-1","1:1.31.4-1~deb10u1","1:1.31.5-1","1:1.31.5-2","1:1.31.5-3","1:1.31.6-1","1:1.31.6-1~deb10u1","1:1.31.7-1","1:1.31.7-1~deb10u1","1:1.31.8-1"],"bundled":6},{"source":"osv","ecosystem":"Debian:11","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.35.8-1~deb11u1"}]}],"versions":["1:1.35.2-1","1:1.35.3-1","1:1.35.4-1","1:1.35.4-1+deb11u2","1:1.35.4-1~deb11u1","1:1.35.5-1","1:1.35.5-2","1:1.35.6-1","1:1.35.7-1"],"bundled":15},{"source":"osv","ecosystem":"Mageia:8","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.6-1.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.27.3-1","1:1.27.4-1","1:1.27.4-2","1:1.27.4-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.31.2-1ubuntu1","1:1.31.5-1","1:1.31.5-1ubuntu1","1:1.31.5-2","1:1.31.5-3","1:1.31.5-3ubuntu1","1:1.31.6-1","1:1.31.7-1","1:1.31.7-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.35.3-1","1:1.35.4-1","1:1.35.5-1","1:1.35.5-1ubuntu1","1:1.35.5-1ubuntu2","1:1.35.5-1ubuntu3","1:1.35.6-1","1:1.35.6-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.39.4-2","1:1.39.5-1","1:1.39.6-1","1:1.39.7-1","1:1.39.7-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.43.1+dfsg-1","1:1.43.1+dfsg-2","1:1.43.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.43.8+dfsg-2","1:1.43.9+dfsg-1","1:1.43.9+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.43.3+dfsg-1","1:1.43.5+dfsg-1","1:1.43.6+dfsg-2","1:1.43.8+dfsg-1","1:1.43.8+dfsg-2"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"fedoraproject","product":"fedora"},{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"https://phabricator.wikimedia.org/T297543","tags":["x_transferred","Issue Tracking","Patch","Vendor Advisory","web","report"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/PT4CHJKOQOVMI65TSNZRNV6FIWU7SGZD/","tags":["vendor-advisory","x_transferred","web","advisory"]},{"url":"https://lists.debian.org/debian-lts-announce/2022/09/msg00027.html","tags":["mailing-list","x_transferred","Mailing List","Third Party Advisory","web","article"]},{"url":"https://www.debian.org/security/2022/dsa-5246","tags":["vendor-advisory","x_transferred","Third Party Advisory","web","advisory"]},{"url":"https://security.gentoo.org/glsa/202305-24","tags":["vendor-advisory","x_transferred","web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28202","tags":["web","advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/PT4CHJKOQOVMI65TSNZRNV6FIWU7SGZD/"},{"url":"https://github.com/advisories/GHSA-5c63-m98j-vx6v"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28202.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2022-28202","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0145.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30231","tags":["report"]},{"url":"https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/YJNXKPV5Z56NSUQ4G3SXPDUIZG5EQ7UR/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-28202","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28202","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-28202","description":"An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.","status":"published","published":"2022-03-30T00:00:00Z","modified":"2024-08-03T05:48:37.387Z","updated_at":"2026-11-02T14:34:38.922686Z"}],"euvd":[{"id":"EUVD-2022-32656","description":"An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.","status":"published","published":"2022-03-30T00:00:00Z","modified":"2024-08-03T05:48:37Z","updated_at":"2026-11-03T03:25:41.002Z"}],"ghsa":[{"id":"GHSA-5c63-m98j-vx6v","title":"An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1...","description":"An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.","status":"published","published":"2022-03-31T00:00:24Z","modified":"2023-05-22T00:30:19Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:54:35.559556Z"}],"nvd":[{"id":"CVE-2022-28202","description":"An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.","status":"published","published":"2022-03-30T06:15:06.98Z","modified":"2026-06-17T04:38:09.253Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:07:14.706146Z"}],"osv":[{"id":"DEBIAN-CVE-2022-28202","description":"An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.","status":"published","published":"2022-03-30T06:15:06.98Z","modified":"2026-11-03T08:01:11.545257553Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T08:25:01.007408Z"},{"id":"UBUNTU-CVE-2022-28202","description":"An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.","status":"published","published":"2022-03-30T06:15:00Z","modified":"2026-10-17T12:55:58.253742052Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"BIT-mediawiki-2022-28202","description":"An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.","status":"published","published":"2024-03-06T11:07:12.265Z","modified":"2025-04-03T14:40:37.652Z","updated_at":"2026-11-02T15:28:33.072289Z"},{"id":"CVE-2022-28202","description":"An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.","status":"published","published":"2022-03-30T00:00:00Z","modified":"2026-10-28T02:30:32.995249456Z","updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"DLA-3117-1","title":"mediawiki - security update","status":"published","published":"2022-09-22T00:00:00Z","modified":"2026-03-09T01:22:59.339357Z","updated_at":"2026-11-02T15:46:11.189256Z"},{"id":"DSA-5246-1","title":"mediawiki - security update","status":"published","published":"2022-10-04T00:00:00Z","modified":"2026-03-09T02:10:52.19395Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"MGASA-2022-0145","title":"Updated mediawiki packages fix security vulnerability","description":"Title::newMainPage() goes into an infinite recursion loop if it points to a\nlocal interwiki (CVE-2022-28201).\n\nMessages widthheight/widthheightpage/nbytes not escaped when used in galleries\nor Special:RevisionDelete (CVE-2022-28202).\n\nRequesting Special:NewFiles on a wiki with many file uploads with actor as a\ncondition can result in a DoS (CVE-2022-28203).\n\nSpecial:WhatLinksHere can result in a DoS when a page is used on a extremely\nlarge number of other pages (CVE-2022-28204).\n","status":"published","published":"2022-04-18T07:42:17Z","modified":"2026-04-16T04:40:40.967794929Z","updated_at":"2026-11-02T15:49:41.849028Z"}]}}