CVE-2022-29906: 
NixOS vulnerability analysis and mitigation

The admin API module in the QuizGame extension for MediaWiki through 1.37.2 (before commit 665e33a68f6fa1167df99c0aa18ed0157cdf9f66) contains a security vulnerability where it omits a check for the quizadmin user. This vulnerability was discovered and disclosed on April 29, 2022 (NVD, MITRE).

The vulnerability exists in the admin API module of the QuizGame extension, where it fails to properly validate user permissions by omitting a check for the quizadmin user role. This security oversight could potentially allow unauthorized users to access administrative functions (NVD).

The vulnerability could allow unauthorized users to gain access to administrative functions within the QuizGame extension, potentially compromising the security and integrity of the quiz system (NVD).

The vulnerability affects MediaWiki installations running the QuizGame extension through version 1.37.2, before the patch was implemented in commit 665e33a68f6fa1167df99c0aa18ed0157cdf9f66 (MITRE).

The vulnerability has been fixed in commit 665e33a68f6fa1167df99c0aa18ed0157cdf9f66. Users are advised to update their QuizGame extension to a version containing this fix (NVD).