CVE-2014-7295 — Cross-site Scripting in Mediawiki

CWE-79 — Cross-site Scripting5 documents5 sources
Severity
3.5LOWNVD
EPSS
0.2%
top 53.10%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MediawikiDebian Mediawiki
Timeline
PublishedOct 7
Latest updateMay 17

Description

The (1) Special:Preferences and (2) Special:UserLogin pages in MediaWiki before 1.19.20, 1.22.x before 1.22.12 and 1.23.x before 1.23.5 allows remote authenticated users to conduct cross-site scripting (XSS) attacks or have unspecified other impact via crafted CSS, as demonstrated by modifying MediaWiki:Common.css.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 6.8 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/mediawiki< mediawiki 1:1.19.20+dfsg-1 (bookworm)
▶Debianmediawiki/mediawiki< 1:1.19.20+dfsg-1+3
▶NVDmediawiki/mediawiki1.19.19+37

Patches

Patch: bugzilla.wikimedia.org ↗Patch: bugzilla.wikimedia.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-ch24-8hv8-9rmv: The (1) Special:Preferences and (2) Special:UserLogin pages in MediaWiki before 1↗2022-05-17
▶
OSV
CVE-2014-7295: The (1) Special:Preferences and (2) Special:UserLogin pages in MediaWiki before 1↗2014-10-07
▶

📋Vendor Advisories

1
Debian
CVE-2014-7295: mediawiki - The (1) Special:Preferences and (2) Special:UserLogin pages in MediaWiki before ...↗2014
▶

💬Community

1
Bugzilla
CVE-2014-7295 mediawiki: remove separation of css and js module allowance issue fixed in versions 1.19.20, 1.22.12, and 1.23.5.↗2014-10-02
▶
CVE-2014-7295 — Cross-site Scripting in Mediawiki | cvebase