MediumFix available
mediawiki — security advisory
An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.
- Products
- mediawiki
- Affected versions
- Not specified
- Fixed versions
- 1:1.35.6-1
- CVEs
- CVE-2022-28202
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 14:49 UTC · Revision 1
Source evidence
An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.
osv:DEBIAN-CVE-2022-28202
mediawiki
Fixed versions: 1:1.35.6-1
mediawiki
Fixed versions: 1:1.35.6-1
mediawiki
Fixed versions: 1:1.35.6-1
Complete source record
{
"id": "da5a6d7d39339ef4c25e6131f70a7dcca3e22a2d78ada13b9e6fde3f6b1f1239",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2022-28202",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2022-28202",
"summary": "An XSS issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. The widthheight, widthheightpage, and nbytes properties of messages are not escaped when used in galleries or Special:RevisionDelete.",
"evidence": "osv:DEBIAN-CVE-2022-28202",
"products": [
{
"name": {
"value": "mediawiki",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:1.35.6-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "mediawiki",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:1.35.6-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "mediawiki",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "1:1.35.6-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "medium",
"structured": {
"id": "DEBIAN-CVE-2022-28202",
"aliases": [
"DEBIAN-CVE-2022-28202"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.35.6-1"
}
]
}
],
"package": {
"name": "mediawiki",
"purl": "pkg:deb/debian/mediawiki?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-28202.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.35.6-1"
}
]
}
],
"package": {
"name": "mediawiki",
"purl": "pkg:deb/debian/mediawiki?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-28202.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "1:1.35.6-1"
}
]
}
],
"package": {
"name": "mediawiki",
"purl": "pkg:deb/debian/mediawiki?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-28202.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-15T08:02:28.209932994Z",
"provider": "osv",
"upstream": [
"CVE-2022-28202"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2022-28202"
]
},
"related_cves": [
{
"value": "CVE-2022-28202",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 323435,
"published_at": "2022-03-30T06:15:06.98+00:00"
}