high7.5
CVE-2023-45363
MediaWiki Denial of Service vulnerability
Impact
An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop and RequestTimeoutException) when querying pages redirected to other variants with redirects and converttitles set.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | mediawiki/core | < 1.35.12 | 1.35.12 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Mediawiki | Mediawiki | before 1.35.12 from 1.36.0 before 1.39.5 Version 1.40.0 |
| Debian | Debian Linux | Versions 11.0, 12.0 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://lists.debian.org/debian-lts-announce/2023/11/msg00027.html
- https://phabricator.wikimedia.org/T333050
- https://www.debian.org/security/2023/dsa-5520
- https://github.com/advisories/GHSA-w5fx-cx7f-6vr9
- https://nvd.nist.gov/vuln/detail/CVE-2023-45363
- https://github.com/wikimedia/mediawiki/commit/24c3ef2474c6daa20ed48168d46196a55346dfd8