GHSA-w5fx-cx7f-6vr9HighCVSS 7.5

MediaWiki Denial of Service vulnerability

Published
October 9, 2023
Last Modified
October 30, 2024

🔗 CVE IDs covered (1)

CVE-2023-45363 →

📋 Description

An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop and RequestTimeoutException) when querying pages redirected to other variants with redirects and converttitles set.

🎯 Affected products3

  • composer/mediawiki/core:< 1.35.12
  • composer/mediawiki/core:>= 1.36.0, < 1.39.5
  • composer/mediawiki/core:= 1.40.0

🔗 References (6)