CVE-2022-41767: Mediawiki

Medium severity, CVSS 5.3. EPSS: 0.7% chance of exploitation in the next 30 days.

An issue was discovered in MediaWiki before 1.35.8, 1.36.x and 1.37.x before 1.37.5, and 1.38.x before 1.38.3. When changes made by an IP address are reassigned to a user (using reassignEdits.php), the changes will still be attributed to the IP address on Special:Contributions when doing a range lookup.

Affected products

• Mediawiki Mediawiki: before 1.35.8 (fixed in 1.35.8); from 1.36.0, before 1.37.5 (fixed in 1.37.5); from 1.38.0, before 1.38.3 (fixed in 1.38.3)

Published 2022-12-26. Last modified 2026-06-17.