CVE-2021-41799: MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time)

High severity · published Oct 11, 2021

CVE-2021-41799

MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time)

7.5

CVSS

1.7%

EPSS

On KEV

Description

MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). ApiQueryBacklinks (action=query&list=backlinks) can cause a full table scan.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.7% · higher than 77% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Fedora · Fedoraproject

33; 34; 35 · source: NVD

Mediawiki · Mediawiki

before 1.36.2 · source: NVD

Affected product

Fedora

Fedoraproject

All Fedora CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2021-41799

CVE.org

https://www.cve.org/CVERecord?id=CVE-2021-41799

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA/

lists.fedoraproject.org

https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/

lists.wikimedia.org

https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/

Permissions Required

https://phabricator.wikimedia.org/T290394

security.gentoo.org

https://security.gentoo.org/glsa/202305-24