Denial of Service Vulnerability in MediaWiki by Wikimedia
CVE-2023-45363

7.5HIGH

Key Information:

Vendor

Mediawiki
Status
Mediawiki
Vendor
CVE Published:
9 October 2023

What is CVE-2023-45363?

A vulnerability in MediaWiki’s ApiPageSet.php was identified that potentially allows attackers to exploit the application’s redirects functionality. When querying pages redirected to other variants, if the 'converttitles' parameter is set and the system encounters an unexpected input, it can lead to an infinite loop situation, resulting in a denial-of-service condition. This vulnerability affects multiple versions of MediaWiki, emphasizing the need for users to upgrade to the latest released versions to mitigate this risk.

References

https://phabricator.wikimedia.org/T333050
https://www.debian.org/security/2023/dsa-5520
vendor-advisory
https://lists.debian.org/debian-lts-announce/2023/11/msg0...
mailing-list

EPSS Score

22% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.