Description

The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) omits a check for the quizadmin user.

Remediation

References

CVE-2022-29906

Related Vulnerabilities

WordPress Plugin OnePress Social Locker Multiple Unspecified Vulnerabilities (4.2.5)

WordPress Plugin Ocean Extra Security Bypass (1.5.8)

e107 Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2018-16389)

ATutor Improper Authentication Vulnerability (CVE-2014-9753)

Liferay DXP Incorrect Authorization Vulnerability (CVE-2025-43789)

Severity

Critical

Classification

CVE-2022-29906 CWE-863 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities