Vulnerability · Published Apr 29, 2022 · Assigned by mitre
CVE-2022-29904
Critical 9.8
In plain English
A critical-severity security flaw in the affected software. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 16.8% (higher than 97% of all known vulnerabilities).
Severity (CVSS NVD)9.8Critical
Exploit odds (30 days)16.8%top 2.9% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
The SemanticDrilldown extension for MediaWiki through 1.37.2 (before e688bdba6434591b5dff689a45e4d53459954773) allows SQL injection with certain '-' and '_' constraints.
Affected products (as reported)
References
- https://phabricator.wikimedia.org/T306463 x_refsource_MISC
- https://gerrit.wikimedia.org/r/c/mediawiki/extensions/SemanticDrilldown/+/785213 x_refsource_MISC