CVE-2021-32722 Uncontrolled Resource Consumption in GlobalNewFiles
An attacker can overwhelm database servers by performing rapid page moves, causing denial of service in the GlobalNewFiles MediaWiki extension.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2021-32722?
CVE-2021-32722 is a medium-severity denial of service vulnerability in miraheze GlobalNewFiles, published on 28 Jun 2021. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
GlobalNewFiles is a mediawiki extension. Versions prior to 48be7adb70568e20e961ea1cb70904454a671b1d are affected by an uncontrolled resource consumption vulnerability. A large amount of page moves within a short space of time could overwhelm Database servers due to improper handling of load balancing and a lack of an appropriate index. As a workaround, one may avoid use of the extension unless additional rate limit at the MediaWiki level or via PoolCounter / MySQL is enabled. A patch is available in version 48be7adb70568e20e961ea1cb70904454a671b1d.
Weakness: CWE-400
Which versions are affected by CVE-2021-32722?
It affects 1 product.
Products include Miraheze Globalnewfiles.
How do I fix CVE-2021-32722?
No fix has been published for CVE-2021-32722 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2021-32722 being exploited?
There is no known exploitation of CVE-2021-32722 in the wild and no public exploit code.
Other vulnerabilities in miraheze GlobalNewFiles
Sources
Also known as GHSA-cwv5-c938-5h5h.