CVE-2021-41118
Medium
Description
The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. In affected versions unsanitised input of regular expression date within the parameters of the DPL parser function, allowed for the possibility of ReDoS (Regex Denial of Service). This has been resolved in version 3.3.6. If you are unable to update you may also set `$wgDplSettings['functionalRichness'] = 0;` or disable DynamicPageList3 to mitigate.
SeverityMedium
CVSS5.3
Exploit probability—
ProductDynamicpagelist3
PublishedOct 4, 2021
First seenOct 4, 2021
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- dynamicpagelist3_project dynamicpagelist33.3.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| dynamicpagelist3_project dynamicpagelist3 | v < 3.3.6 | 3.3.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.