VDB
Sign up
HIGH7.5

GHSA-w5fx-cx7f-6vr9

MediaWiki Denial of Service vulnerability

Quick fix

GHSA-w5fx-cx7f-6vr9 — mediawiki/core: upgrade to the fixed version with the command below.

composer require mediawiki/core:^1.35.12

Details

An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop and RequestTimeoutException) when querying pages redirected to other variants with redirects and converttitles set.

Are you affected?

Enter the version of the package you're using.

Affected packages

Packagist/mediawiki/core
Introduced in: 0Fixed in: 1.35.12
Fixcomposer require mediawiki/core:^1.35.12
Packagist/mediawiki/core
Introduced in: 1.36.0Fixed in: 1.39.5
Fixcomposer require mediawiki/core:^1.39.5
Packagist/mediawiki/core
Introduced in: 1.40.0Fixed in: 1.40.1
Fixcomposer require mediawiki/core:^1.40.1

References