MediaWiki Denial of Service vulnerability
High severity
GitHub Reviewed
Published
Oct 9, 2023
to the GitHub Advisory Database
•
Updated Oct 30, 2024
Package
Affected versions
< 1.35.12
>= 1.36.0, < 1.39.5
= 1.40.0
Patched versions
1.35.12
1.39.5
1.40.1
Description
Published by the National Vulnerability Database
Oct 9, 2023
Published to the GitHub Advisory Database
Oct 9, 2023
Reviewed
Oct 30, 2024
Last updated
Oct 30, 2024
An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop and RequestTimeoutException) when querying pages redirected to other variants with redirects and converttitles set.
References