Search for vulnerabilities
Vulnerability details: VCID-ah5y-k5sb-aaap
Vulnerability ID VCID-ah5y-k5sb-aaap
Aliases CVE-2021-41800
GHSA-c8wv-qwwc-6j73
Summary MediaWiki before 1.36.2 allows a denial of service (resource consumption because of lengthy query processing time). Visiting Special:Contributions can sometimes result in a long running SQL query because PoolCounter protection is mishandled.
Status Published
Exploitability 0.5
Weighted Severity 6.2
Risk 3.1
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-770 Allocation of Resources Without Limits or Throttling
CWE-400 Uncontrolled Resource Consumption
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 5.3 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41800.json
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00151 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00159 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00263 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00263 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00263 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00263 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00263 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00263 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00263 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00263 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00263 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00263 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00271 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00271 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00271 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00271 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00295 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
epss 0.00374 https://api.first.org/data/v1/epss?cve=CVE-2021-41800
rhbs medium https://bugzilla.redhat.com/show_bug.cgi?id=2009517
cvssv3.1_qr MODERATE https://github.com/advisories/GHSA-c8wv-qwwc-6j73
cvssv3.1 5.3 https://github.com/wikimedia/mediawiki/commit/781caf83dba90c18349f930bbaaa0e89f003f874
generic_textual MODERATE https://github.com/wikimedia/mediawiki/commit/781caf83dba90c18349f930bbaaa0e89f003f874
cvssv3.1 5.3 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN
generic_textual MODERATE https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN
cvssv3.1 5.3 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA
generic_textual MODERATE https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA
cvssv3.1 5.3 https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX
generic_textual MODERATE https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX
cvssv3.1 5.3 https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5
generic_textual MODERATE https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5
cvssv2 5.0 https://nvd.nist.gov/vuln/detail/CVE-2021-41800
cvssv3 5.3 https://nvd.nist.gov/vuln/detail/CVE-2021-41800
cvssv3.1 5.3 https://nvd.nist.gov/vuln/detail/CVE-2021-41800
cvssv3.1 5.3 https://phabricator.wikimedia.org/T284419
generic_textual MODERATE https://phabricator.wikimedia.org/T284419
archlinux Medium https://security.archlinux.org/AVG-2434
cvssv3.1 7.7 https://security.gentoo.org/glsa/202305-24
generic_textual HIGH https://security.gentoo.org/glsa/202305-24
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41800.json
https://api.first.org/data/v1/epss?cve=CVE-2021-41800
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-35197
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41798
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41799
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41800
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41801
https://github.com/wikimedia/mediawiki/commit/781caf83dba90c18349f930bbaaa0e89f003f874
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA/
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA/
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX
https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX/
https://lists.wikimedia.org/hyperkitty/list/wikitech-l%40lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/
https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5
https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5/
https://phabricator.wikimedia.org/T284419
https://security.gentoo.org/glsa/202305-24
2009517 https://bugzilla.redhat.com/show_bug.cgi?id=2009517
AVG-2434 https://security.archlinux.org/AVG-2434
cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:34:*:*:*:*:*:*:*
cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:fedoraproject:fedora:35:*:*:*:*:*:*:*
CVE-2021-41800 https://nvd.nist.gov/vuln/detail/CVE-2021-41800
GHSA-c8wv-qwwc-6j73 https://github.com/advisories/GHSA-c8wv-qwwc-6j73
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2021-41800.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/wikimedia/mediawiki/commit/781caf83dba90c18349f930bbaaa0e89f003f874
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/CJDYJQWT43GBD6GNQ4OW7JOZ6WQ6DZTN
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/MDBPECBWN6LWNSWIQMVXK6PP4YFEUYHA
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/QNEAI2T3Y65I55ZB6UE6RMC662RZTGRX
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://lists.wikimedia.org/hyperkitty/list/wikitech-l@lists.wikimedia.org/thread/2IFS5CM2YV4VMSODPX3J2LFHKSEWVFV5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P Found at https://nvd.nist.gov/vuln/detail/CVE-2021-41800
Exploitability (E) Access Vector (AV) Access Complexity (AC) Authentication (Au) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

high

functional

unproven

proof_of_concept

not_defined

local

adjacent_network

network

high

medium

low

multiple

single

none

none

partial

complete

none

partial

complete

none

partial

complete
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2021-41800
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://nvd.nist.gov/vuln/detail/CVE-2021-41800
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://phabricator.wikimedia.org/T284419
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N Found at https://security.gentoo.org/glsa/202305-24
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.32351
EPSS Score 0.00151
Published At March 28, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
There are no relevant records.