PT-2024-3257 · Mediawiki+2 · Mediawiki+2

Dreamy_Jazz · Published 2024-02-16 · Updated 2025-06-19 · CVE-2024-34506

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.39.7 MediaWiki versions 1.40.x prior to 1.40.3 MediaWiki versions 1.41.x prior to 1.41.1

Description An issue in the includes/specials/SpecialMovePage.php file of MediaWiki can lead to a denial of service. If a user with the necessary rights to move a page opens Special:MovePage for a page with tens of thousands of subpages, the page will exceed the maximum request time, resulting in a denial of service.

Recommendations For MediaWiki versions prior to 1.39.7, update to version 1.39.7 or later. For MediaWiki versions 1.40.x prior to 1.40.3, update to version 1.40.3 or later. For MediaWiki versions 1.41.x prior to 1.41.1, update to version 1.41.1 or later. As a temporary workaround, consider restricting access to the Special:MovePage page for users with the necessary rights to move pages, especially for pages with a large number of subpages.

Fix

DoS

Resource Exhaustion

Improper Resource Release

Weakness Enumeration

CWE-400

CWE-404

Related Identifiers

ALT-PU-2025-5905

BDU:2024-03488

BIT-MEDIAWIKI-2024-34506

CVE-2024-34506

DLA-3796-1

DSA-5651-1

Affected Products

Alt Linux

Mediawiki

Red Os

References · 35

• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY · Vendor Advisory
• https://osv.dev/vulnerability/DLA-3796-1 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2024-34506 · Security Note
• https://phabricator.wikimedia.org/T357760 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-34506 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/FU2FGUXXK6TMV6R52VRECLC6XCSQQISY · Vendor Advisory
• https://osv.dev/vulnerability/DSA-5651-1 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2024-34506 · Vendor Advisory
• https://ubuntu.com/security/CVE-2024-34506 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-mediawiki-2024-34506 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2024-34506 · Vendor Advisory
• http://repo.red-soft.ru/redos/7.3c/x86_64/updates · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-34506 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2024-34506 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-03488 · Security Note