Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.5
CVE-2024-34506: MediaWiki Special Move Page Denial of Service
CVE-2024-34506 · published 2 years ago
Summary
MediaWiki's special move page feature can be exploited by a malicious user with the right permissions to cause a denial of service, potentially freezing the system for a long time. This affects MediaWiki versions before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. To mitigate this risk, update to the latest version of MediaWiki.
What to do
- Update debian mediawiki to version 1:1.39.7-1~deb12u1.
- Update debian mediawiki to version 1:1.39.7-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:18.04:LTS | canonical | mediawiki | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | mediawiki | All versions |
| Ubuntu:Pro:22.04:LTS | canonical | mediawiki | All versions |
| Debian:12 | debian | mediawiki |
< 1:1.39.7-1~deb12u1 Fix: upgrade to 1:1.39.7-1~deb12u1
|
| Debian:13 | debian | mediawiki |
< 1:1.39.7-1 Fix: upgrade to 1:1.39.7-1
|
| – | mediawiki | mediawiki |
< 1.39.7 >= 1.40.0, < 1.40.3 >= 1.41.0, < 1.41.1 cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:* |
| – | fedoraproject | fedora |
40 cpe:2.3:o:fedoraproject:fedora:40:*:*:*:*:*:*:* |
Original advisory text
An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. If a user with the necessary rights to move the page ope...
An issue was discovered in includes/specials/SpecialMovePage.php in MediaWiki before 1.39.7, 1.40.x before 1.40.3, and 1.41.x before 1.41.1. If a user with the necessary rights to move the page opens Special:MovePage for a page with tens of thousands of subpages, then the page will exceed the maximum request time, leading to a denial of service.
References
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/34xxx/CVE-2024-34506... Vendor Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2024-34506 Vendor Advisory
- https://ubuntu.com/security/CVE-2024-34506 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2024-34506 Third Party Advisory
- https://lists.wikimedia.org/hyperkitty/list/[email protected]/threa... Third Party Advisory
- https://gerrit.wikimedia.org/r/c/mediawiki/core/+/1015423 Third Party Advisory
- https://phabricator.wikimedia.org/T357760 URL
- https://security-tracker.debian.org/tracker/CVE-2024-34506 Vendor Advisory
- https://lists.fedoraproject.org/archives/list/[email protected]... URL
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorapro... Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-400Uncontrolled Resource Consumption
Timeline
Published5 May 2024
Updated3 Nov 2026
First seen27 May 2026
Sources
UBUNTU-CVE-2024-34506 · OSV
CVE-2024-34506 · NVD
DEBIAN-CVE-2024-34506 · OSV
CVE-2024-34506 · OSV
Track software like this
Free during beta