MediaWiki up to 1.35.7/1.37.4/1.38.2 HTMLUserTextField information disclosure

Summaryinfo

A vulnerability was found in MediaWiki up to 1.35.7/1.37.4/1.38.2. It has been rated as problematic. The impacted element is an unknown function. The manipulation of the argument HTMLUserTextField leads to information disclosure. This vulnerability is traded as CVE-2022-41765. There is no exploit available. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as problematic, has been found in MediaWiki up to 1.35.7/1.37.4/1.38.2 (Content Management System). This issue affects an unknown function. The manipulation of the argument HTMLUserTextField with an unknown input leads to a information disclosure vulnerability. Using CWE to declare the problem leads to CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. Impacted is confidentiality. The summary by CVE is:

An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. HTMLUserTextField exposes the existence of hidden users.

The weakness was shared 12/26/2022. It is possible to read the advisory at phabricator.wikimedia.org. The identification of this vulnerability is CVE-2022-41765 since 09/29/2022. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 245189 (Linux Distros Unpatched Vulnerability : CVE-2022-41765), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 1.35.8, 1.37.5 or 1.38.3 eliminates this vulnerability.

The vulnerability is also documented in the databases at Tenable (245189) and EUVD (EUVD-2022-44936). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Content Management System

Name

• MediaWiki

Version

• 1.35.0
• 1.35.1
• 1.35.2
• 1.35.3
• 1.35.4
• 1.35.5
• 1.35.6
• 1.35.7
• 1.37.0
• 1.37.1
• 1.37.2
• 1.37.3
• 1.37.4
• 1.38.0
• 1.38.1
• 1.38.2

License

• open-source

Website

• Product: https://www.mediawiki.org/wiki/MediaWiki

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion