Description
An issue was discovered in MediaWiki before 1.35.6, 1.36.x before 1.36.4, and 1.37.x before 1.37.2. Users with the editinterface permission can trigger infinite recursion, because a bare local interwiki is mishandled for the mainpage message.
References (4)
Scores
CVSS v3
4.4
EPSS
0.0007
EPSS Percentile
20.5%
Attack Vector
LOCAL
CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H
Details
CWE
CWE-674
Status
published
Products (3)
debian/debian_linux
10.0
debian/debian_linux
11.0
mediawiki/mediawiki
< 1.35.6
Published
Sep 19, 2022
Tracked Since
Feb 18, 2026