CVE-2023-29139 Denial of service in n/a
Authenticated users with checkuser permissions can cause denial of service via excessive API requests in specific configurations.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-29139?
CVE-2023-29139 is a medium-severity denial of service vulnerability in Mediawiki Mediawiki, published on 31 Mar 2023. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
An issue was discovered in the CheckUser extension for MediaWiki through 1.39.3. When a user with checkuserlog permissions makes many CheckUserLog API requests in some configurations, denial of service can occur (RequestTimeoutException or upstream request timeout).
Weakness: CWE-400
Which versions are affected by CVE-2023-29139?
1 open source package ship an affected version, including mediawiki. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
mediawiki Bitnami | All versions | 1.39.4 |
Products include Mediawiki Mediawiki.
How do I fix CVE-2023-29139?
Upgrade mediawiki to 1.39.4 or later.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2023-29139 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-29139 exists.
Other vulnerabilities in Mediawiki Mediawiki
Sources
Also known as BIT-mediawiki-2023-29139, GHSA-j4f5-gw7r-fr82.