CVE-2014-9475 — Cross-site Scripting in Mediawiki

CWE-79 — Cross-site Scripting5 documents5 sources

Severity

3.5LOWNVD

EPSS

0.2%

top 62.73%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Mediawiki Debian Mediawiki

Timeline

PublishedJan 16

Latest updateMay 17

Description

Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 6.8 | Impact: 2.9

Affected Packages3 packages

▶debiandebian/mediawiki< mediawiki 1:1.19.20+dfsg-2.2 (bookworm)

▶Debianmediawiki/mediawiki< 1:1.19.20+dfsg-2.2+3

▶NVDmediawiki/mediawiki1.19.22+45

🔴Vulnerability Details

GHSA

GHSA-68mq-r5mx-h5r5: Cross-site scripting (XSS) vulnerability in thumb↗2022-05-17

▶

OSV

CVE-2014-9475: Cross-site scripting (XSS) vulnerability in thumb↗2015-01-16

▶

📋Vendor Advisories

Debian

CVE-2014-9475: mediawiki - Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.2...↗2014

▶

💬Community

Bugzilla

CVE-2014-9475 CVE-2014-9476 CVE-2014-9477 CVE-2014-9478 CVE-2014-9479 CVE-2014-9480 CVE-2014-9481 CVE-2014-9487 mediawiki: multiple vulnerabilities↗2014-12-18

▶