Denial of Service Vulnerability in MediaWiki by Wikimedia
CVE-2021-46149

7.5HIGH

Key Information:

Vendor

Mediawiki
Status
Mediawiki
Vendor
CVE Published:
10 January 2022

What is CVE-2021-46149?

A vulnerability exists in MediaWiki versions before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1 that allows attackers to achieve a denial of service through resource exhaustion. This is done by executing searches with extremely long keys in the Language Name Search feature, leading to significant performance degradation and possible service interruptions.

References

https://phabricator.wikimedia.org/T293749
x_refsource_MISC
https://gerrit.wikimedia.org/r/q/Ide32704cca578b9aecbce34...
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.