CVE-2014-2242: XSS
First published: Fri Feb 28 2014(Updated: )
includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/mediawiki | <1.22.3 | 1.22.3 |
| redhat/mediawiki | <1.21.6 | 1.21.6 |
| redhat/mediawiki | <1.19.12 | 1.19.12 |
| MediaWiki | <=1.19.11 | |
| MediaWiki | =1.1.0 | |
| MediaWiki | =1.10.0 | |
| MediaWiki | =1.10.0-rc1 | |
| MediaWiki | =1.10.0-rc2 | |
| MediaWiki | =1.10.1 | |
| MediaWiki | =1.10.2 | |
| MediaWiki | =1.10.3 | |
| MediaWiki | =1.10.4 | |
| MediaWiki | =1.11 | |
| MediaWiki | =1.11.0 | |
| MediaWiki | =1.11.0-rc1 | |
| MediaWiki | =1.11.1 | |
| MediaWiki | =1.11.2 | |
| MediaWiki | =1.12.0 | |
| MediaWiki | =1.12.0-rc1 | |
| MediaWiki | =1.12.1 | |
| MediaWiki | =1.12.2 | |
| MediaWiki | =1.12.3 | |
| MediaWiki | =1.12.4 | |
| MediaWiki | =1.13.0 | |
| MediaWiki | =1.13.0-rc1 | |
| MediaWiki | =1.13.0-rc2 | |
| MediaWiki | =1.13.1 | |
| MediaWiki | =1.13.2 | |
| MediaWiki | =1.13.3 | |
| MediaWiki | =1.13.4 | |
| MediaWiki | =1.14.0 | |
| MediaWiki | =1.14.0-rc1 | |
| MediaWiki | =1.14.1 | |
| MediaWiki | =1.15.0 | |
| MediaWiki | =1.15.0-rc1 | |
| MediaWiki | =1.15.1 | |
| MediaWiki | =1.15.2 | |
| MediaWiki | =1.15.3 | |
| MediaWiki | =1.15.4 | |
| MediaWiki | =1.15.5 | |
| MediaWiki | =1.16.0 | |
| MediaWiki | =1.16.0-beta1 | |
| MediaWiki | =1.16.0-beta2 | |
| MediaWiki | =1.16.0-beta3 | |
| MediaWiki | =1.16.1 | |
| MediaWiki | =1.16.2 | |
| MediaWiki | =1.17 | |
| MediaWiki | =1.17-beta_1 | |
| MediaWiki | =1.17.0 | |
| MediaWiki | =1.17.0-rc1 | |
| MediaWiki | =1.17.1 | |
| MediaWiki | =1.17.2 | |
| MediaWiki | =1.17.3 | |
| MediaWiki | =1.17.4 | |
| MediaWiki | =1.18 | |
| MediaWiki | =1.18-beta_1 | |
| MediaWiki | =1.18.0 | |
| MediaWiki | =1.18.0-rc1 | |
| MediaWiki | =1.18.1 | |
| MediaWiki | =1.18.2 | |
| MediaWiki | =1.18.3 | |
| MediaWiki | =1.19 | |
| MediaWiki | =1.19-beta_1 | |
| MediaWiki | =1.19-beta_2 | |
| MediaWiki | =1.19.0 | |
| MediaWiki | =1.19.1 | |
| MediaWiki | =1.19.2 | |
| MediaWiki | =1.19.3 | |
| MediaWiki | =1.19.4 | |
| MediaWiki | =1.19.5 | |
| MediaWiki | =1.19.6 | |
| MediaWiki | =1.19.7 | |
| MediaWiki | =1.19.8 | |
| MediaWiki | =1.19.9 | |
| MediaWiki | =1.19.10 | |
| MediaWiki | =1.20 | |
| MediaWiki | =1.20.1 | |
| MediaWiki | =1.20.2 | |
| MediaWiki | =1.20.3 | |
| MediaWiki | =1.20.4 | |
| MediaWiki | =1.20.5 | |
| MediaWiki | =1.20.6 | |
| MediaWiki | =1.20.7 | |
| MediaWiki | =1.20.8 | |
| MediaWiki | =1.21 | |
| MediaWiki | =1.21.1 | |
| MediaWiki | =1.21.2 | |
| MediaWiki | =1.21.3 | |
| MediaWiki | =1.21.4 | |
| MediaWiki | =1.21.5 | |
| MediaWiki | =1.22.0 | |
| MediaWiki | =1.22.1 | |
| MediaWiki | =1.22.2 | |
| <=1.19.11 | ||
| =1.1.0 | ||
| =1.10.0 | ||
| =1.10.0-rc1 | ||
| =1.10.0-rc2 | ||
| =1.10.1 | ||
| =1.10.2 | ||
| =1.10.3 | ||
| =1.10.4 | ||
| =1.11 | ||
| =1.11.0 | ||
| =1.11.0-rc1 | ||
| =1.11.1 | ||
| =1.11.2 | ||
| =1.12.0 | ||
| =1.12.0-rc1 | ||
| =1.12.1 | ||
| =1.12.2 | ||
| =1.12.3 | ||
| =1.12.4 | ||
| =1.13.0 | ||
| =1.13.0-rc1 | ||
| =1.13.0-rc2 | ||
| =1.13.1 | ||
| =1.13.2 | ||
| =1.13.3 | ||
| =1.13.4 | ||
| =1.14.0 | ||
| =1.14.0-rc1 | ||
| =1.14.1 | ||
| =1.15.0 | ||
| =1.15.0-rc1 | ||
| =1.15.1 | ||
| =1.15.2 | ||
| =1.15.3 | ||
| =1.15.4 | ||
| =1.15.5 | ||
| =1.16.0 | ||
| =1.16.0-beta1 | ||
| =1.16.0-beta2 | ||
| =1.16.0-beta3 | ||
| =1.16.1 | ||
| =1.16.2 | ||
| =1.17 | ||
| =1.17-beta_1 | ||
| =1.17.0 | ||
| =1.17.0-rc1 | ||
| =1.17.1 | ||
| =1.17.2 | ||
| =1.17.3 | ||
| =1.17.4 | ||
| =1.18 | ||
| =1.18-beta_1 | ||
| =1.18.0 | ||
| =1.18.0-rc1 | ||
| =1.18.1 | ||
| =1.18.2 | ||
| =1.18.3 | ||
| =1.19 | ||
| =1.19-beta_1 | ||
| =1.19-beta_2 | ||
| =1.19.0 | ||
| =1.19.1 | ||
| =1.19.2 | ||
| =1.19.3 | ||
| =1.19.4 | ||
| =1.19.5 | ||
| =1.19.6 | ||
| =1.19.7 | ||
| =1.19.8 | ||
| =1.19.9 | ||
| =1.19.10 | ||
| =1.20 | ||
| =1.20.1 | ||
| =1.20.2 | ||
| =1.20.3 | ||
| =1.20.4 | ||
| =1.20.5 | ||
| =1.20.6 | ||
| =1.20.7 | ||
| =1.20.8 | ||
| =1.21 | ||
| =1.21.1 | ||
| =1.21.2 | ||
| =1.21.3 | ||
| =1.21.4 | ||
| =1.21.5 | ||
| =1.22.0 | ||
| =1.22.1 | ||
| =1.22.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html
- http://openwall.com/lists/oss-security/2014/02/28/1
- http://openwall.com/lists/oss-security/2014/03/01/2
- http://www.securityfocus.com/bid/65910
- https://bugzilla.redhat.com/show_bug.cgi?id=1071135
- https://bugzilla.wikimedia.org/show_bug.cgi?id=60771
- https://gerrit.wikimedia.org/r/#/q/7d923a6b53f7fbcb0cbc3a19797d741bf6f440eb,n,z
- https://gerrit.wikimedia.org/r/#/q/7d923a6b53f7fbcb0cbc3a19797d741bf6f440eb%2Cn%2Cz
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=60771
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1071142
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1071143
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1071157
- http://www.openwall.com/lists/oss-security/2014/02/28/1
- https://access.redhat.com/security/cve/CVE-2014-2242
- http://www.openwall.com/lists/oss-security/2014/03/01/2
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1091963
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1071135#c9
Frequently Asked Questions
What is the severity of CVE-2014-2242?
CVE-2014-2242 is classified as a high severity vulnerability due to its potential to allow cross-site scripting (XSS) attacks.
How do I fix CVE-2014-2242?
To fix CVE-2014-2242, upgrade MediaWiki to version 1.19.12, 1.21.6, 1.22.3, or later.
Which MediaWiki versions are affected by CVE-2014-2242?
CVE-2014-2242 affects MediaWiki versions prior to 1.19.12, 1.21.6, and 1.22.3.
Can CVE-2014-2242 be exploited through SVG files?
Yes, CVE-2014-2242 allows remote attackers to exploit the vulnerability by uploading malicious SVG files.
What type of attack does CVE-2014-2242 facilitate?
CVE-2014-2242 facilitates cross-site scripting (XSS) attacks through improper handling of SVG uploads.
- agent/type
- agent/first-publish-date
- agent/severity
- agent/remedy
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2014-2242
- agent/software-canonical-lookup
- agent/last-modified-date
- agent/references
- agent/event
- agent/trending
- agent/source
- agent/weakness
- collector/nvd-index
- agent/software-canonical-lookup-request
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- package-manager/redhat
- vendor/mediawiki
- canonical/mediawiki
- version/mediawiki/1.19.11
- version/mediawiki/1.1.0
- version/mediawiki/1.10.0
- version/mediawiki/1.10.0-rc1
- version/mediawiki/1.10.0-rc2
- version/mediawiki/1.10.1
- version/mediawiki/1.10.2
- version/mediawiki/1.10.3
- version/mediawiki/1.10.4
- version/mediawiki/1.11
- version/mediawiki/1.11.0
- version/mediawiki/1.11.0-rc1
- version/mediawiki/1.11.1
- version/mediawiki/1.11.2
- version/mediawiki/1.12.0
- version/mediawiki/1.12.0-rc1
- version/mediawiki/1.12.1
- version/mediawiki/1.12.2
- version/mediawiki/1.12.3
- version/mediawiki/1.12.4
- version/mediawiki/1.13.0
- version/mediawiki/1.13.0-rc1
- version/mediawiki/1.13.0-rc2
- version/mediawiki/1.13.1
- version/mediawiki/1.13.2
- version/mediawiki/1.13.3
- version/mediawiki/1.13.4
- version/mediawiki/1.14.0
- version/mediawiki/1.14.0-rc1
- version/mediawiki/1.14.1
- version/mediawiki/1.15.0
- version/mediawiki/1.15.0-rc1
- version/mediawiki/1.15.1
- version/mediawiki/1.15.2
- version/mediawiki/1.15.3
- version/mediawiki/1.15.4
- version/mediawiki/1.15.5
- version/mediawiki/1.16.0
- version/mediawiki/1.16.0-beta1
- version/mediawiki/1.16.0-beta2
- version/mediawiki/1.16.0-beta3
- version/mediawiki/1.16.1
- version/mediawiki/1.16.2
- version/mediawiki/1.17
- version/mediawiki/1.17-beta_1
- version/mediawiki/1.17.0
- version/mediawiki/1.17.0-rc1
- version/mediawiki/1.17.1
- version/mediawiki/1.17.2
- version/mediawiki/1.17.3
- version/mediawiki/1.17.4
- version/mediawiki/1.18
- version/mediawiki/1.18-beta_1
- version/mediawiki/1.18.0
- version/mediawiki/1.18.0-rc1
- version/mediawiki/1.18.1
- version/mediawiki/1.18.2
- version/mediawiki/1.18.3
- version/mediawiki/1.19
- version/mediawiki/1.19-beta_1
- version/mediawiki/1.19-beta_2
- version/mediawiki/1.19.0
- version/mediawiki/1.19.1
- version/mediawiki/1.19.2
- version/mediawiki/1.19.3
- version/mediawiki/1.19.4
- version/mediawiki/1.19.5
- version/mediawiki/1.19.6
- version/mediawiki/1.19.7
- version/mediawiki/1.19.8
- version/mediawiki/1.19.9
- version/mediawiki/1.19.10
- version/mediawiki/1.20
- version/mediawiki/1.20.1
- version/mediawiki/1.20.2
- version/mediawiki/1.20.3
- version/mediawiki/1.20.4
- version/mediawiki/1.20.5
- version/mediawiki/1.20.6
- version/mediawiki/1.20.7
- version/mediawiki/1.20.8
- version/mediawiki/1.21
- version/mediawiki/1.21.1
- version/mediawiki/1.21.2
- version/mediawiki/1.21.3
- version/mediawiki/1.21.4
- version/mediawiki/1.21.5
- version/mediawiki/1.22.0
- version/mediawiki/1.22.1
- version/mediawiki/1.22.2