CVE-2022-28202
Fixed in a distro release EPSS 1%
An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.
Products: mediawiki, fedoraproject fedora, debian_linux
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Arch Linux | mediawiki | 1.37.2-1 |
| Debian 10 | mediawiki | 1:1.31.16-1+deb10u3 |
| Debian 11 | mediawiki | 1:1.35.8-1~deb11u1 |
| Debian 12 | mediawiki | 1:1.35.6-1 |
| Debian 13 | mediawiki | 1:1.35.6-1 |
| Debian 14 | mediawiki | 1:1.35.6-1 |
| Ubuntu 18.04 LTS | mediawiki | no fix |
| Ubuntu 25.10 | mediawiki | no fix |
| Ubuntu 26.04 LTS | mediawiki | no fix |
| Ubuntu 26.10 | mediawiki | no fix |
| Ubuntu Pro 20.04 LTS | mediawiki | no fix |
| Ubuntu Pro 22.04 LTS | mediawiki | no fix |
| Ubuntu Pro 24.04 LTS | mediawiki | no fix |