CVE-2026-22712

{"id": "CVE-2026-22712", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-22712", "role": "CISA Coordinator", "options": [{"exploitation": "poc"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-01-09T19:15:14.724928Z"}}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 4.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 1.4, "exploitabilityScore": 2.8}], "cvssMetricV40": [{"type": "Secondary", "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:P/VC:L/VI:L/VA:L/SC:L/SI:L/SA:L/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "PASSIVE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "LOW", "vulnIntegrityImpact": "LOW", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "LOW", "vulnAvailabilityImpact": "LOW", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "affectedData": [{"vendor": "The Wikimedia Foundation", "product": "Mediawiki - ApprovedRevs Extension", "versions": [{"status": "affected", "version": "1.45"}, {"status": "affected", "version": "1.44"}, {"status": "affected", "version": "1.43"}, {"status": "affected", "version": "1.39"}], "defaultStatus": "unaffected"}]}], "published": "2026-01-09T00:15:45.837", "references": [{"url": "https://gerrit.wikimedia.org/r/q/Iee1bf1cbc8a519899e7f9dde508856bd4e5a5d2a", "tags": ["Patch"], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}, {"url": "https://phabricator.wikimedia.org/T412068", "tags": ["Exploit", "Issue Tracking"], "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}, {"url": "https://phabricator.wikimedia.org/T412068", "tags": ["Exploit", "Issue Tracking"], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Secondary", "source": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc", "description": [{"lang": "en", "value": "CWE-116"}]}], "descriptions": [{"lang": "en", "value": "Improper Encoding or Escaping of Output\u00a0due to magic word replacement in ParserAfterTidy vulnerability in The Wikimedia Foundation Mediawiki - ApprovedRevs Extension allows Input Data Manipulation.This issue affects Mediawiki - ApprovedRevs Extension: 1.45, 1.44, 1.43, 1.39."}, {"lang": "es", "value": "Codificaci\u00f3n o escape incorrectos de la salida debido al reemplazo de palabra m\u00e1gica en la vulnerabilidad ParserAfterTidy en la Extensi\u00f3n ApprovedRevs de Mediawiki de la Fundaci\u00f3n Wikimedia permite la manipulaci\u00f3n de datos de entrada. Este problema afecta a la Extensi\u00f3n ApprovedRevs de Mediawiki: 1.45, 1.44, 1.43, 1.39."}], "lastModified": "2026-06-17T10:20:16.893", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:wikiworks:approved_revs:1.39:*:*:*:*:mediawiki:*:*", "vulnerable": true, "matchCriteriaId": "0680AAB5-C5C7-42A3-9CB3-D99E0126955B"}, {"criteria": "cpe:2.3:a:wikiworks:approved_revs:1.43:*:*:*:*:mediawiki:*:*", "vulnerable": true, "matchCriteriaId": "293B8B8B-6988-4E0A-AC72-B49D7C98C050"}, {"criteria": "cpe:2.3:a:wikiworks:approved_revs:1.44:*:*:*:*:mediawiki:*:*", "vulnerable": true, "matchCriteriaId": "30B9A0EC-4B7F-4B53-B073-B18291ECB4F6"}, {"criteria": "cpe:2.3:a:wikiworks:approved_revs:1.45:*:*:*:*:mediawiki:*:*", "vulnerable": true, "matchCriteriaId": "73ADBE38-7AFF-4A77-8294-5786ABC4C852"}], "operator": "OR"}]}], "sourceIdentifier": "c4f26cc8-17ff-4c99-b5e2-38fc1793eacc"}