Vulnerability Description
An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop and RequestTimeoutException) when querying pages redirected to other variants with redirects and converttitles set.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Mediawiki | Mediawiki | < 1.35.12 |
| Debian | Debian Linux | 11.0 |
Related Weaknesses (CWE)
References
- https://lists.debian.org/debian-lts-announce/2023/11/msg00027.html
- https://phabricator.wikimedia.org/T333050ExploitThird Party AdvisoryVendor Advisory
- https://www.debian.org/security/2023/dsa-5520Third Party Advisory
- https://lists.debian.org/debian-lts-announce/2023/11/msg00027.html
- https://phabricator.wikimedia.org/T333050ExploitThird Party AdvisoryVendor Advisory
- https://www.debian.org/security/2023/dsa-5520Third Party Advisory
FAQ
What is CVE-2023-45363?
CVE-2023-45363 is a vulnerability with a CVSS score of 7.5 (HIGH). An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop a...
How severe is CVE-2023-45363?
CVE-2023-45363 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2023-45363?
Check the references section above for vendor advisories and patch information. Affected products include: Mediawiki Mediawiki, Debian Debian Linux.