CVE-2021-41799 — Allocation of Resources Without Limits or Throttling in Mediawiki

CWE-770 — Allocation of Resources Without Limits or ThrottlingCWE-400 — Uncontrolled Resource Consumption5 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.3%
top 49.70%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
MediawikiDebian MediawikiFedoraproject Fedora
Timeline
PublishedOct 11
Latest updateMay 24

Description

MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). ApiQueryBacklinks (action=query&list=backlinks) can cause a full table scan.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶debiandebian/mediawiki< mediawiki 1:1.35.4-1 (bookworm)
▶NVDmediawiki/mediawiki< 1.36.2
▶Debianmediawiki/mediawiki< 1:1.35.4-1~deb11u1+3

Also affects: Fedora 33, 34, 35

🔴Vulnerability Details

2
GHSA
GHSA-h7pp-5ppj-95mv: MediaWiki before 1↗2022-05-24
▶
OSV
CVE-2021-41799: MediaWiki before 1↗2021-10-11
▶

📋Vendor Advisories

2
Red Hat
mediawiki: ApiQueryBacklinks can cause a full table scan and as a result DoS↗2021-09-30
▶
Debian
CVE-2021-41799: mediawiki - MediaWiki before 1.36.2 allows a denial of service (resource consumption because...↗2021
▶
CVE-2021-41799 — Mediawiki vulnerability | cvebase