CVE-2014-1610: Input Validation
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandlerbody.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
MediaWikito a version that resolves this vulnerability.Fixed in 1.22.2 - Upgrade
Upgrade
MediaWikito a version that resolves this vulnerability.Fixed in 1.21.5 - Upgrade
Upgrade
MediaWikito a version that resolves this vulnerability.Fixed in 1.19.11
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1610?
CVE-2014-1610 is considered a critical vulnerability due to its potential to allow remote command execution.
How do I fix CVE-2014-1610?
To fix CVE-2014-1610, you should upgrade MediaWiki to version 1.22.2, 1.21.5, or 1.19.11 or later.
Which versions of MediaWiki are affected by CVE-2014-1610?
CVE-2014-1610 affects MediaWiki versions 1.22.0, 1.22.1, 1.21.0 to 1.21.4, and 1.19.0 to 1.19.10.
What are the potential impacts of CVE-2014-1610?
The potential impacts of CVE-2014-1610 include remote attackers executing arbitrary commands on the server.
Is my MediaWiki installation vulnerable to CVE-2014-1610?
If you are using MediaWiki versions earlier than 1.22.2, 1.21.5, or 1.19.11 with DjVu or PDF support enabled, your installation is vulnerable to CVE-2014-1610.