CVE-2021-32722

    Dashboard / Vulnerabilities / CVE-2021-32722

    CVE-2021-32722

    Published: 28 Jun 2021Last Modified: 9 Jul 2026

    Summary:

    Details: GlobalNewFiles is a mediawiki extension. Versions prior to 48be7adb70568e20e961ea1cb70904454a671b1d are affected by an uncontrolled resource consumption vulnerability. A large amount of page moves within a short space of time could overwhelm Database servers due to improper handling of load balancing and a lack of an appropriate index. As a workaround, one may avoid use of the extension unless additional rate limit at the MediaWiki level or via PoolCounter / MySQL is enabled. A patch is available in version 48be7adb70568e20e961ea1cb70904454a671b1d.

    References: https://github.com/miraheze/GlobalNewFiles/security/advisories/GHSA-cwv5-c938-5h5h, https://phabricator.miraheze.org/T7532, https://github.com/miraheze/GlobalNewFiles/commit/48be7adb70568e20e961ea1cb70904454a671b1d, https://github.com/miraheze/GlobalNewFiles/pull/17

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -48be7adb70568e20e961ea1cb70904454a671b1d

    Affected versions

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-32722 | CVE-DB