Semantic MediaWiki 2.5.0 before 7.3.1 Resource Exhaustion via #set_recurring_event
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 7.3.1
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
Summary
Semantic MediaWiki, an extension for the MediaWiki wiki platform, is affected by this vulnerability. A user with only low-level editing rights can craft wiki pages that create an enormous number of recurring event records, which can overwhelm the server's processing power, memory, and database and degrade or disrupt the wiki.
Summarized by anthropic/claude-haiku-5.5. Verify details against the original sources.
Read the original description
Semantic MediaWiki from 2.5.0 before 7.3.1 contains an uncontrolled resource consumption vulnerability that allows low-privilege editors to bypass smwgMaxNumRecurringEvents by supplying a large limit parameter. Attackers can save pages using #set_recurring_event without an end date to generate thousands or millions of date subobjects, exhausting CPU, memory, and database resources.
Timeline
- CVE published
- Record last updated
- First seen by cve.now
Affected versions
- SemanticMediaWiki SemanticMediaWiki
From 2.5.0 · fixed in 7.3.1