Rate Limiting Vulnerability in MediaWiki's Wikibase Extension
CVE-2023-45371

7.5HIGH

Key Information:

Vendor

Mediawiki
Status
Mediawiki
Vendor
CVE Published:
9 October 2023

What is CVE-2023-45371?

A vulnerability exists in the Wikibase extension for MediaWiki that allows for the merging of items without proper rate limiting. This oversight can be exploited by an attacker to execute excessive merge operations in a short period, potentially leading to system overload or denial of service. Affected versions include those prior to 1.35.12, all versions from 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. Users are advised to upgrade to the latest versions to mitigate this risk.

References

https://phabricator.wikimedia.org/T345064
https://gerrit.wikimedia.org/r/c/mediawiki/extensions/Wik...

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.