~ / search / GHSA-w5fx-cx7f-6vr9

GHSA-w5fx-cx7f-6vr9

MediaWiki Denial of Service vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2023-45363

Packages

EcosystemPackageAffectedFixed in
Packagist mediawiki/core < 1.35.12 1.35.12
Packagist mediawiki/core >= 1.36.0, < 1.39.5 1.39.5
Packagist mediawiki/core >= 1.40.0, < 1.40.1 1.40.1

Details

As written in the advisory (Markdown source, shown as plain text).

An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop and RequestTimeoutException) when querying pages redirected to other variants with redirects and converttitles set.

References

External links from the advisory. They lead to third-party sites.