Bitnami package
mediawiki
pkg:bitnami/mediawiki
Vulnerabilities (172)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2022-29906 | — | < 1.37.3 | 1.37.3 | Apr 29, 2022 | The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check for the quizadmin user. | ||
| CVE-2022-29907 | — | < 1.37.3 | 1.37.3 | Apr 29, 2022 | The Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb868345701d9544a54d9752515aace39df) allows XSS in Advertise link messages. | ||
| CVE-2022-28209 | — | < 1.37.2 | 1.37.2 | Mar 30, 2022 | An issue was discovered in Mediawiki through 1.37.1. The check for the override-antispoof permission in the AntiSpoof extension is incorrect. | ||
| CVE-2022-28206 | — | < 1.37.2 | 1.37.2 | Mar 30, 2022 | An issue was discovered in MediaWiki through 1.37.1. ImportPlanValidator.php in the FileImporter extension mishandles the check for edit rights. | ||
| CVE-2022-28205 | — | < 1.37.2 | 1.37.2 | Mar 30, 2022 | An issue was discovered in MediaWiki through 1.37.1. The CentralAuth extension mishandles a ttl issue for groups expiring in the future. | ||
| CVE-2022-28202 | — | < 1.35.6 | 1.35.6 | Mar 30, 2022 | An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete. | ||
| CVE-2021-46147 | — | < 1.35.5 | 1.35.5 | Jan 7, 2022 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. MassEditRegex allows CSRF. | ||
| CVE-2021-46148 | — | < 1.35.5 | 1.35.5 | Jan 7, 2022 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Some unprivileged users can view confidential information (e.g., IP addresses and User-Agent headers for election traffic) on a testwiki SecurePoll instance. | ||
| CVE-2021-46149 | — | < 1.35.5 | 1.35.5 | Jan 7, 2022 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A denial of service (resource consumption) can be accomplished by searching for a very long key in a Language Name Search. | ||
| CVE-2021-46150 | — | < 1.35.5 | 1.35.5 | Jan 7, 2022 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Special:CheckUserLog allows CheckUser XSS because of date mishandling, as demonstrated by an XSS payload in MediaWiki:October. | ||
| CVE-2021-46146 | — | < 1.35.5 | 1.35.5 | Jan 7, 2022 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The WikibaseMediaInfo component is vulnerable to XSS via the caption fields for a given media file. | ||
| CVE-2021-45471 | — | < 1.37.1 | 1.37.1 | Dec 24, 2021 | In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items. | ||
| CVE-2021-45472 | — | < 1.37.1 | 1.37.1 | Dec 24, 2021 | In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used. | ||
| CVE-2021-45473 | — | < 1.3.8 | 1.3.8 | Dec 24, 2021 | In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-information sidebar). | ||
| CVE-2021-45474 | — | < 1.37.1 | 1.37.1 | Dec 24, 2021 | In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl parameter. | ||
| CVE-2021-44858 | — | < 1.35.5 | 1.35.5 | Dec 20, 2021 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=mcrundo and action=mcrrestore to view private pages on a private wiki that has at least one page set in $wgWhitelistRead. | ||
| CVE-2021-45038 | — | < 1.35.5 | 1.35.5 | Dec 17, 2021 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. By using an action=rollback query, attackers can view private wiki contents. | ||
| CVE-2021-44857 | — | < 1.35.5 | 1.35.5 | Dec 17, 2021 | An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page (that the user doesn't have edit rights for). This applies to any pu | ||
| CVE-2021-41801 | — | < 1.31.16 | 1.31.16 | Oct 11, 2021 | The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked after submitting a replace job, the job is still run, even if it may be run at a later time (due to the job queue backlog) | ||
| CVE-2021-41800 | — | < 1.36.2 | 1.36.2 | Oct 11, 2021 | MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). Visiting Special:Contributions can sometimes result in a long running SQL query because PoolCounter protection is mishandled. |
- CVE-2022-29906Apr 29, 2022affected < 1.37.3fixed 1.37.3
The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check for the quizadmin user.
- CVE-2022-29907Apr 29, 2022affected < 1.37.3fixed 1.37.3
The Nimbus skin for MediaWiki through 1.37.2 (before 6f9c8fb868345701d9544a54d9752515aace39df) allows XSS in Advertise link messages.
- CVE-2022-28209Mar 30, 2022affected < 1.37.2fixed 1.37.2
An issue was discovered in Mediawiki through 1.37.1. The check for the override-antispoof permission in the AntiSpoof extension is incorrect.
- CVE-2022-28206Mar 30, 2022affected < 1.37.2fixed 1.37.2
An issue was discovered in MediaWiki through 1.37.1. ImportPlanValidator.php in the FileImporter extension mishandles the check for edit rights.
- CVE-2022-28205Mar 30, 2022affected < 1.37.2fixed 1.37.2
An issue was discovered in MediaWiki through 1.37.1. The CentralAuth extension mishandles a ttl issue for groups expiring in the future.
- CVE-2022-28202Mar 30, 2022affected < 1.35.6fixed 1.35.6
An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.
- CVE-2021-46147Jan 7, 2022affected < 1.35.5fixed 1.35.5
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. MassEditRegex allows CSRF.
- CVE-2021-46148Jan 7, 2022affected < 1.35.5fixed 1.35.5
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Some unprivileged users can view confidential information (e.g., IP addresses and User-Agent headers for election traffic) on a testwiki SecurePoll instance.
- CVE-2021-46149Jan 7, 2022affected < 1.35.5fixed 1.35.5
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. A denial of service (resource consumption) can be accomplished by searching for a very long key in a Language Name Search.
- CVE-2021-46150Jan 7, 2022affected < 1.35.5fixed 1.35.5
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. Special:CheckUserLog allows CheckUser XSS because of date mishandling, as demonstrated by an XSS payload in MediaWiki:October.
- CVE-2021-46146Jan 7, 2022affected < 1.35.5fixed 1.35.5
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. The WikibaseMediaInfo component is vulnerable to XSS via the caption fields for a given media file.
- CVE-2021-45471Dec 24, 2021affected < 1.37.1fixed 1.37.1
In MediaWiki through 1.37, blocked IP addresses are allowed to edit EntitySchema items.
- CVE-2021-45472Dec 24, 2021affected < 1.37.1fixed 1.37.1
In MediaWiki through 1.37, XSS can occur in Wikibase because an external identifier property can have a URL format that includes a $1 formatter substitution marker, and the javascript: URL scheme (among others) can be used.
- CVE-2021-45473Dec 24, 2021affected < 1.3.8fixed 1.3.8
In MediaWiki through 1.37, Wikibase item descriptions allow XSS, which is triggered upon a visit to an action=info URL (aka a page-information sidebar).
- CVE-2021-45474Dec 24, 2021affected < 1.37.1fixed 1.37.1
In MediaWiki through 1.37, the Special:ImportFile URI (aka FileImporter) allows XSS, as demonstrated by the clientUrl parameter.
- CVE-2021-44858Dec 20, 2021affected < 1.35.5fixed 1.35.5
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=edit&undo= followed by action=mcrundo and action=mcrrestore to view private pages on a private wiki that has at least one page set in $wgWhitelistRead.
- CVE-2021-45038Dec 17, 2021affected < 1.35.5fixed 1.35.5
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. By using an action=rollback query, attackers can view private wiki contents.
- CVE-2021-44857Dec 17, 2021affected < 1.35.5fixed 1.35.5
An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. It is possible to use action=mcrundo followed by action=mcrrestore to replace the content of any arbitrary page (that the user doesn't have edit rights for). This applies to any pu
- CVE-2021-41801Oct 11, 2021affected < 1.31.16fixed 1.31.16
The ReplaceText extension through 1.41 for MediaWiki has Incorrect Access Control. When a user is blocked after submitting a replace job, the job is still run, even if it may be run at a later time (due to the job queue backlog)
- CVE-2021-41800Oct 11, 2021affected < 1.36.2fixed 1.36.2
MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). Visiting Special:Contributions can sometimes result in a long running SQL query because PoolCounter protection is mishandled.
Page 5 of 9