-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| mediawiki/core | composer | < 1.35.12 | 1.35.12 |
| mediawiki/core | composer | >= 1.36.0, < 1.39.5 | 1.39.5 |
| mediawiki/core | composer | = 1.40.0 | 1.40.1 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from the loop in loadRedirectTargets() when resolving redirect targets. The original code (before the patch) did not check if a title had already been processed via mConvertTitles/mConvertedTitles. This allowed attackers to create a scenario where a title redirects to another variant, which then gets converted back to the original title, causing an infinite loop. The patch explicitly adds a condition to break this cycle by checking mConvertTitles and mConvertedTitles, confirming this function's role in the vulnerability.