VYPR
← All advisories
High severity7.5NVD Advisory· Published Oct 9, 2023· Updated Jun 17, 2026

CVE-2023-45363

CVE-2023-45363

Description

An issue was discovered in ApiPageSet.php in MediaWiki before 1.35.12, 1.36.x through 1.39.x before 1.39.5, and 1.40.x before 1.40.1. It allows attackers to cause a denial of service (unbounded loop and RequestTimeoutException) when querying pages redirected to other variants with redirects and converttitles set.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
mediawiki/corePackagist
< 1.35.121.35.12
mediawiki/corePackagist
>= 1.36.0, < 1.39.51.39.5
mediawiki/corePackagist
>= 1.40.0, < 1.40.11.40.1

Affected products

7
  • MediaWiki/Mediawiki3 versions
    cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*+ 2 more
    • cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*range: <1.35.12
    • cpe:2.3:a:mediawiki:mediawiki:1.40.0:-:*:*:*:*:*:*
    • (no CPE)
  • Debian/linux2 versions
    cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*
    • cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*
  • osv-coords2 versions
    pkg:bitnami/mediawikipkg:composer/mediawiki/core
    < 1.35.12+ 1 more
    • (no CPE)range: < 1.35.12
    • (no CPE)range: < 1.35.12

Patches

Vulnerability mechanics

References

6

News mentions

0

No linked articles in our index yet.