BIT-mediawiki-2022-29906

vendorUSosv

view advisory published 2024-03-06Licence: per source

The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check for the quizadmin user.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2022-29906US	critical9.8OT elevated	1.27% (70th)	—	2022-04-29
The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check for the quizadmin user.

references

External citations — patches, advisories, analysis.

https://gerrit.wikimedia.org/r/c/mediawiki/extensions/QuizGame/+/765651WEB
https://nvd.nist.gov/vuln/detail/CVE-2022-29906WEB
https://phabricator.wikimedia.org/T302199WEB

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan