CVE-2022-28201

An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinite recursion, because a bare local interwiki is mishandled for the mainpage message.

• CWE-674

• https://blog.legoktm.com/2022/07/03/a-belated-writeup-of-cve-2022-28201-in-mediawiki.htmlExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/09/msg00027.htmlMailing List, Third Party Advisory
• https://phabricator.wikimedia.org/T297571Patch, Vendor Advisory
• https://www.debian.org/security/2022/dsa-5246Third Party Advisory
• https://blog.legoktm.com/2022/07/03/a-belated-writeup-of-cve-2022-28201-in-mediawiki.htmlExploit, Third Party Advisory
• https://lists.debian.org/debian-lts-announce/2022/09/msg00027.htmlMailing List, Third Party Advisory
• https://phabricator.wikimedia.org/T297571Patch, Vendor Advisory
• https://www.debian.org/security/2022/dsa-5246Third Party Advisory

Published

Sep 19, 2022

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2022-28196NVIDIA Jetson Linux Driver Package contains a vulnerability …4.6
• CVE-2022-28197NVIDIA Jetson Linux Driver Package contains a vulnerability …5
• CVE-2022-28198NVIDIA Omniverse Nucleus and Cache contain a vulnerability i…6.8
• CVE-2022-28199NVIDIA’s distribution of the Data Plane Development Kit (MLN…6.5
• CVE-2022-2820Session Fixation in GitHub repository namelessmc/nameless pr…8.2
• CVE-2022-28200NVIDIA DGX A100 contains a vulnerability in SBIOS in the Bio…8.2
• CVE-2022-28202An XSS issue was discovered in MediaWiki before 1.35.6, 1.36…6.1
• CVE-2022-28203A denial-of-service issue was discovered in MediaWiki before…7.5
• CVE-2022-28204A denial-of-service issue was discovered in MediaWiki 1.37.x…7.5
• CVE-2022-28205An issue was discovered in MediaWiki through 1.37.1. The Cen…9.8
• CVE-2022-28206An issue was discovered in MediaWiki through 1.37.1. ImportP…9.8
• CVE-2022-28209An issue was discovered in Mediawiki through 1.37.1. The che…9.8