| Package | Affected versions | Patched versions |
|---|---|---|
| mediawiki/core | ≥ 1.36.0, < 1.39.5≥ 1.40.0, < 1.40.1< 1.35.12 | 1.39.51.40.11.35.12 |
| mediawiki | = 1.40.0≥ 1.36.0, < 1.39.5< 1.35.12 | 1.39.51.35.12 |
An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop and RequestTimeoutException) when querying pages redirected to other variants with redirects and converttitles set.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free