CVE-2021-32722

MediumCVSS 6.5/10Last modified Jun 17, 2026

Description

GlobalNewFiles is a mediawiki extension. Versions prior to 48be7adb70568e20e961ea1cb70904454a671b1d are affected by an uncontrolled resource consumption vulnerability. A large amount of page moves within a short space of time could overwhelm Database servers due to improper handling of load balancing and a lack of an appropriate index. As a workaround, one may avoid use of the extension unless additional rate limit at the MediaWiki level or via PoolCounter / MySQL is enabled. A patch is available in version 48be7adb70568e20e961ea1cb70904454a671b1d.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400

Affected software

Vendor	Product	Versions
miraheze	GlobalNewFiles	< 48be7adb70568e20e961ea1cb70904454a671b1d

References

https://github.com/miraheze/GlobalNewFiles/commit/48be7adb70568e20e961ea1cb70904454a671b1dPatch, Third Party Advisory
https://github.com/miraheze/GlobalNewFiles/pull/17Patch, Third Party Advisory
https://github.com/miraheze/GlobalNewFiles/security/advisories/GHSA-cwv5-c938-5h5hThird Party Advisory
https://phabricator.miraheze.org/T7532Issue Tracking, Vendor Advisory
https://github.com/miraheze/GlobalNewFiles/commit/48be7adb70568e20e961ea1cb70904454a671b1dPatch, Third Party Advisory
https://github.com/miraheze/GlobalNewFiles/pull/17Patch, Third Party Advisory
https://github.com/miraheze/GlobalNewFiles/security/advisories/GHSA-cwv5-c938-5h5hThird Party Advisory
https://phabricator.miraheze.org/T7532Issue Tracking, Vendor Advisory

Timeline

Published: Jun 28, 2021
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2021

CVE-2021-327236.5Prism is a syntax highlighting library. Some languages before 1.24.0 are vulnerable to Regular Expression Denial of Service (ReDoS). When Pr CVE-2021-327249.9check-spelling is a github action which provides CI spell checking. In affected versions and for a repository with the [check-spelling actio CVE-2021-327255.3Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, default share permissio CVE-2021-327269.8Nextcloud Server is a Nextcloud package that handles data storage. In versions prior to 19.0.13, 20.011, and 21.0.3, webauthn tokens were no CVE-2021-327277.5Nextcloud Android Client is the Android client for Nextcloud. Clients using the Nextcloud end-to-end encryption feature download the public CVE-2021-327286.5The Nextcloud Desktop Client is a tool to synchronize files from Nextcloud Server with a computer. Clients using the Nextcloud end-to-end en CVE-2021-327295.4XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A vulnerability exists in versions CVE-2021-32737.2Nagios XI below 5.7 is affected by code injection in the /nagiosxi/admin/graphtemplates.php component. To exploit this vulnerability, someon CVE-2021-327305.7XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. A cross-site request forgery vulner CVE-2021-327315.3XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Between (and including) versions 13 CVE-2021-327326.5### Impact It's possible to know if a user has or not an account in a wiki related to an email address, and which username(s) is actually ti CVE-2021-327336.1Nextcloud Text is a collaborative document editing application that uses Markdown. A cross-site scripting vulnerability is present in versio