-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability stems directly from WatchedItemStore::countVisitingWatchersMultiple's handling of invalid input. Multiple sources (CVE description, Phabricator T204729, and security advisories) explicitly identify this function as the problematic component. The function's failure to properly validate input titles led to unconstrained database queries, matching the CWE-400 (Uncontrolled Resource Consumption) classification. The patch involved adding input validation to prevent empty target sets from triggering full table scans, confirming the function's central role in the vulnerability.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mediawiki/core | composer | >= 1.27.0, < 1.27.6 | 1.27.6 |
| mediawiki/core | composer | >= 1.30.0, < 1.30.2 | 1.30.2 |
| mediawiki/core | composer | >= 1.31.0, < 1.31.2 | 1.31.2 |
| mediawiki/core | composer | >= 1.32.0, < 1.32.2 | 1.32.2 |