Vulnerability · Published Oct 4, 2021 · Assigned by GitHub_M

CVE-2021-41118ReDoS in DynamicPageList3

Medium 5.3

In plain English

A medium-severity uncontrolled resource consumption in DynamicPageList3 from Universal-Omega. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.2% (higher than 67% of all known vulnerabilities).

Severity (CVSS 3.1)5.3Medium

Exploit odds (30 days)1.2%top 32.8% of all CVEs

Exploited in the wildNo reportsnot in CISA KEV

Attack toolingNoneno public tooling known

Official description

The DynamicPageList3 extension is a reporting tool for MediaWiki, listing category members and intersections with various formats and details. In affected versions unsanitised input of regular expression date within the parameters of the DPL parser function, allowed for the possibility of ReDoS (Regex Denial of Service). This has been resolved in version 3.3.6. If you are unable to update you may also set `$wgDplSettings['functionalRichness'] = 0;` or disable DynamicPageList3 to mitigate.

Affected products (as reported)

Vendor	Product	Versions
Universal-Omega	DynamicPageList3	< 3.3.6

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H

References

https://github.com/Universal-Omega/DynamicPageList3/security/advisories/GHSA-8f24-q75c-jhf4 x_refsource_CONFIRM
https://github.com/Universal-Omega/DynamicPageList3/commit/2c04dafb37a14d9ccfe070f53e7f11bbca0156e7 x_refsource_MISC
https://github.com/Universal-Omega/DynamicPageList3/releases/tag/3.3.6 x_refsource_MISC