PT-2021-23102 · Mediawiki · Dynamicpagelist3

Published 2021-10-04 · Updated 2021-10-12 · CVE-2021-41118

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions DynamicPageList3 versions prior to 3.3.6

Description The DynamicPageList3 extension for MediaWiki is affected by an issue where unsanitized input of regular expression data within the parameters of the DPL parser function allows for the possibility of ReDoS (Regex Denial of Service).

Recommendations For versions prior to 3.3.6, update to version 3.3.6 to resolve the issue. As a temporary workaround, consider setting $wgDplSettings['functionalRichness'] = 0; to mitigate the risk. Alternatively, disable DynamicPageList3 to minimize the risk of exploitation.

Fix

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2021-41118

GHSA-8F24-Q75C-JHF4

Affected Products

Dynamicpagelist3

References · 6

• https://github.com/Universal-Omega/DynamicPageList3/commit/2c04dafb37a14d9ccfe070f53e7f11bbca0156e7 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-41118 · Security Note
• https://osv.dev/vulnerability/CVE-2021-41118 · Vendor Advisory
• https://github.com/Universal-Omega/DynamicPageList3/releases/tag/3.3.6 · Note
• https://github.com/Universal-Omega/DynamicPageList3/security/advisories/GHSA-8f24-q75c-jhf4 · Note
• https://t.me/cibsecurity/29922 · Telegram Post