Improper Neutralization of Special Elements used in an Expression Language Statement (Expression Language Injection) vulnerability in The Wikimedia Foundation Mediawiki - DiscussionTools Extension allows Regular Expression Exponential Blowup.This issue affects Mediawiki - DiscussionTools Extension: 1.44, 1.43.
Weakness
The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Mediawiki | Ubuntu | plucky | * |
Potential Mitigations
- If user-controlled data must be added to an expression interpreter, one or more of the following should be performed: