Vulnerability DatabaseCVE-2021-41800

CVE-2021-41800:
PHP vulnerability analysis and mitigation

Overview

CVE-2021-41800 affects MediaWiki versions before 1.36.2, where a denial of service vulnerability exists due to improper handling of PoolCounter protection in Special:Contributions. The vulnerability was discovered and disclosed in September 2021, with patches released in October 2021 (Wikimedia List).

Technical details

The vulnerability stems from a resource consumption issue where visiting Special:Contributions can trigger a long-running SQL query due to mishandled PoolCounter protection. The vulnerability has been assigned a CVSS v3.1 Base Score of 5.3 (Medium) with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating it is network accessible, requires low attack complexity, and primarily impacts system availability (NVD).

Impact

The vulnerability can result in denial of service through resource consumption due to lengthy query processing times. When exploited, it can cause the system to process extended SQL queries, potentially impacting server performance and availability (NVD).

Mitigation and workarounds

The vulnerability has been fixed in MediaWiki version 1.36.2. Users are advised to upgrade to this version or later. The fix involves correcting the PoolCounter protection handling in the Special:Contributions functionality (Wikimedia List, MediaWiki Patch).

Additional resources

Source: This report was generated using AI

View vulnerable instances

Not a Wiz customer? See which CVEs are exploitable in your environment.

Get a CVE Assessment

5.3

Score

Published October 11, 2021

Severity MEDIUM

CNA Score N/A

Affected Technologies

PHP
NixOS

Has Public Exploit No

Has CISA KEV Exploit No

CISA KEV Release Date N/A

CISA KEV Due Date N/A

Exploitation Probability Percentile (EPSS) 44

Exploitation Probability (EPSS) 0.2

Affected packages and libraries

mediawiki
www-apps/mediawiki

Sources

NVD
Debian Security Tracker
- Debian 10, 11, 12 Severity MEDIUMHas FixAdded at: Nov 23, 2021
- Debian 13 Severity MEDIUMHas FixAdded at: Apr 08, 2025
- Debian 14 Severity MEDIUMHas FixAdded at: Aug 10, 2025
Echo
- Echo Severity MEDIUMHas FixAdded at: Nov 18, 2025
Gentoo Advisory Database
- Gentoo Severity LOWHas FixAdded at: May 22, 2023
GitHub Advisory Database
- Composer Severity MEDIUMHas FixAdded at: Feb 04, 2024
Nix
- Nix Severity MEDIUMHas FixAdded at: Nov 01, 2023

Get a CVE risk assessment

Get a prioritized view of CVEs in your cloud—so you can focus on what's exploitable, not just what's listed.

Request assessment

Related PHP vulnerabilities:

CVE ID	Severity	Score	Technologies	Component name	CISA KEV exploit	Has fix	Published date
GHSA-898v-775g-777c	CRITICAL	9.4	PHP	neuron-core/neuron-ai	No	Yes	Dec 09, 2025
GHSA-5j8p-438x-rgg5	CRITICAL	9.3	PHP	onelogin/php-saml	No	Yes	Dec 09, 2025
GHSA-j8g6-5gqc-mq36	HIGH	8.2	PHP	neuron-core/neuron-ai	No	Yes	Dec 09, 2025
GHSA-pvcv-q3q7-266g	HIGH	8.1	PHP	filament/filament	No	Yes	Dec 09, 2025
GHSA-6w82-v552-wjw2	HIGH	7.1	PHP	shopware/shopware	No	Yes	Dec 09, 2025

Free Vulnerability Assessment

Benchmark your Cloud Security Posture

Evaluate your cloud security practices across 9 security domains to benchmark your risk level and identify gaps in your defenses.

Request assessment

Additional Wiz resources

Cloud Vulnerability DB

A community-led vulnerabilities database

Cloud Threat Landscape

A threat intelligence database

PEACH

A tenant isolation framework

Get a personalized demo

Ready to see Wiz in action?

"Best User Experience I have ever seen, provides full visibility to cloud workloads."

David EstlickCISO

"Wiz provides a single pane of glass to see what is going on in our cloud environments."

Adam FletcherChief Security Officer

"We know that if Wiz identifies something as critical, it actually is."

Greg PoniatowskiHead of Threat and Vulnerability Management

Get a demo

CVE-2021-41800: PHP vulnerability analysis and mitigation