CVE-2022-41767: Infoleak
An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. When changes made by an IP address are reassigned to a user (using reassignEdits.php), the changes will still be attributed to the IP address on Special:Contributions when doing a range lookup.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is CVE-2022-41767?
CVE-2022-41767 is an issue discovered in MediaWiki before versions 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3.
How does CVE-2022-41767 affect MediaWiki?
CVE-2022-41767 allows changes made by an IP address to be attributed to the IP address even after being reassigned to a user.
What is the severity of CVE-2022-41767?
The severity of CVE-2022-41767 is medium with a CVSS score of 5.3.
How can I fix CVE-2022-41767 in MediaWiki?
To fix CVE-2022-41767, you should upgrade MediaWiki to version 1.35.8, 1.37.5, or 1.38.3 depending on the installed version.
Where can I find more information about CVE-2022-41767?
You can find more information about CVE-2022-41767 in the following references: [Reference 1](https://phabricator.wikimedia.org/T316304), [Reference 2](https://gerrit.wikimedia.org/r/c/mediawiki/core/+/836891), [Reference 3](https://security-tracker.debian.org/tracker/CVE-2022-41767).