{"id":"CVE-2022-28204","aliases":["BIT-mediawiki-2022-28204","EUVD-2022-32658","GHSA-vxvm-35wp-ppw8","MGASA-2022-0145","UBUNTU-CVE-2022-28204"],"status":"published","title":"A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index...","description":"A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere\u0026target=Property%3AP31\u0026namespace=1\u0026invert=1 can take more than thirty seconds. There is a DDoS risk.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.00956,"percentile":0.61667,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2022-04-18T07:42:17Z","modified":"2026-10-28T02:30:36Z","fixes":[{"ecosystem":"Bitnami","package":"mediawiki","fixed_in":["1.37.2"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Bitnami","package":"mediawiki","ranges":[{"type":"SEMVER","events":[{"introduced":"1.37.0"},{"fixed":"1.37.2"}]}]},{"source":"osv","ecosystem":"Mageia:8","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.35.6-1.mga8"}]}],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.27.3-1","1:1.27.4-1","1:1.27.4-2","1:1.27.4-3"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.31.2-1ubuntu1","1:1.31.5-1","1:1.31.5-1ubuntu1","1:1.31.5-2","1:1.31.5-3","1:1.31.5-3ubuntu1","1:1.31.6-1","1:1.31.7-1","1:1.31.7-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.35.3-1","1:1.35.4-1","1:1.35.5-1","1:1.35.5-1ubuntu1","1:1.35.5-1ubuntu2","1:1.35.5-1ubuntu3","1:1.35.6-1","1:1.35.6-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:24.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.39.4-2","1:1.39.5-1","1:1.39.6-1","1:1.39.7-1","1:1.39.7-1ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.43.1+dfsg-1","1:1.43.1+dfsg-2","1:1.43.3+dfsg-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.43.8+dfsg-2","1:1.43.9+dfsg-1","1:1.43.9+dfsg-1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["1:1.43.3+dfsg-1","1:1.43.5+dfsg-1","1:1.43.6+dfsg-2","1:1.43.8+dfsg-1","1:1.43.8+dfsg-2"]}],"products":[{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"https://phabricator.wikimedia.org/T297754","tags":["x_refsource_MISC","x_transferred","Exploit","Issue Tracking","Patch","Vendor Advisory","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-28204","tags":["web","advisory"]},{"url":"https://github.com/advisories/GHSA-vxvm-35wp-ppw8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2022/28xxx/CVE-2022-28204.json","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2022-0145.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=30231","tags":["report"]},{"url":"https://lists.wikimedia.org/hyperkitty/list/mediawiki-announce@lists.wikimedia.org/thread/YJNXKPV5Z56NSUQ4G3SXPDUIZG5EQ7UR/","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2022-28204","tags":["report"]},{"url":"https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/YJNXKPV5Z56NSUQ4G3SXPDUIZG5EQ7UR/","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-28204","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2022-28204","description":"A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere\u0026target=Property%3AP31\u0026namespace=1\u0026invert=1 can take more than thirty seconds. There is a DDoS risk.","status":"published","published":"2022-09-19T20:48:09Z","modified":"2025-05-29T15:39:18.03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:34:39.233406Z"}],"euvd":[{"id":"EUVD-2022-32658","description":"A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere\u0026target=Property%3AP31\u0026namespace=1\u0026invert=1 can take more than thirty seconds. There is a DDoS risk.","status":"published","published":"2022-09-19T20:48:09Z","modified":"2025-05-29T15:39:18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:35.425302Z"}],"ghsa":[{"id":"GHSA-vxvm-35wp-ppw8","title":"A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index...","description":"A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere\u0026target=Property%3AP31\u0026namespace=1\u0026invert=1 can take more than thirty seconds. There is a DDoS risk.","status":"published","published":"2022-09-20T00:00:21Z","modified":"2025-05-29T18:31:08Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:02:30.221111Z"}],"nvd":[{"id":"CVE-2022-28204","description":"A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere\u0026target=Property%3AP31\u0026namespace=1\u0026invert=1 can take more than thirty seconds. There is a DDoS risk.","status":"published","published":"2022-09-19T21:15:09.527Z","modified":"2026-06-17T04:38:09.48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:07:28.118799Z"}],"osv":[{"id":"CVE-2022-28204","description":"A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere\u0026target=Property%3AP31\u0026namespace=1\u0026invert=1 can take more than thirty seconds. There is a DDoS risk.","status":"published","published":"2022-09-19T20:48:09Z","modified":"2026-10-28T02:30:36.746863313Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:25.164673Z"},{"id":"UBUNTU-CVE-2022-28204","description":"A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere\u0026target=Property%3AP31\u0026namespace=1\u0026invert=1 can take more than thirty seconds. There is a DDoS risk.","status":"published","published":"2022-09-19T21:15:00Z","modified":"2026-10-17T12:56:21.522456347Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:53:53.899276Z"},{"id":"BIT-mediawiki-2022-28204","description":"A denial-of-service issue was discovered in MediaWiki 1.37.x before 1.37.2. Rendering of w/index.php?title=Special%3AWhatLinksHere\u0026target=Property%3AP31\u0026namespace=1\u0026invert=1 can take more than thirty seconds. There is a DDoS risk.","status":"published","published":"2024-03-06T11:06:48.799Z","modified":"2025-04-03T14:40:37.652Z","updated_at":"2026-11-02T15:28:33.072289Z"},{"id":"MGASA-2022-0145","title":"Updated mediawiki packages fix security vulnerability","description":"Title::newMainPage() goes into an infinite recursion loop if it points to a\nlocal interwiki (CVE-2022-28201).\n\nMessages widthheight/widthheightpage/nbytes not escaped when used in galleries\nor Special:RevisionDelete (CVE-2022-28202).\n\nRequesting Special:NewFiles on a wiki with many file uploads with actor as a\ncondition can result in a DoS (CVE-2022-28203).\n\nSpecial:WhatLinksHere can result in a DoS when a page is used on a extremely\nlarge number of other pages (CVE-2022-28204).\n","status":"published","published":"2022-04-18T07:42:17Z","modified":"2026-04-16T04:40:40.967794929Z","updated_at":"2026-11-02T15:49:41.849028Z"}]}}