CVE-2022-28323

Vulnerability

The SecurePoll extension in MediaWiki through version 1.37.2 allows a data leak because it supports sorting results by timestamp [1]. This feature exposes the chronological order of votes.

Exploitation

An attacker with access to the poll results page can observe the sort order by timestamp, potentially deducing the sequence in which votes were cast [1]. No authentication beyond normal poll viewing is required.

Impact

The vulnerability leads to information disclosure: an attacker can infer the relative timing of votes, which may reveal sensitive patterns or voting behavior [1]. The confidentiality of voting data is partially compromised.

Mitigation

The issue was reported in Phabricator [1]. The fix is expected in a future release. Users should update MediaWiki once a patched version is available.