CVE-2014-3966: XSS
Published Jun 6, 2014
·Updated
Cross-site scripting (XSS) vulnerability in Special:PasswordReset in MediaWiki before 1.19.16, 1.21.x before 1.21.10, and 1.22.x before 1.22.7, when wgRawHtml is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid username.
Affected Software
33 affected components
MediaWiki MediaWiki<=1.19.15
MediaWiki MediaWiki=1.19.0
MediaWiki MediaWiki=1.19.1
MediaWiki MediaWiki=1.19.2
MediaWiki MediaWiki=1.19.3
MediaWiki MediaWiki=1.19.4
MediaWiki MediaWiki=1.19.5
MediaWiki MediaWiki=1.19.6
MediaWiki MediaWiki=1.19.7
MediaWiki MediaWiki=1.19.8
MediaWiki MediaWiki=1.19.9
MediaWiki MediaWiki=1.19.10
MediaWiki MediaWiki=1.19.11
MediaWiki MediaWiki=1.19.12
MediaWiki MediaWiki=1.19.13
MediaWiki MediaWiki=1.19.14
MediaWiki MediaWiki=1.22.0
MediaWiki MediaWiki=1.22.1
MediaWiki MediaWiki=1.22.2
MediaWiki MediaWiki=1.22.3
MediaWiki MediaWiki=1.22.4
MediaWiki MediaWiki=1.22.5
MediaWiki MediaWiki=1.22.6
MediaWiki MediaWiki=1.21
MediaWiki MediaWiki=1.21.1
MediaWiki MediaWiki=1.21.2
MediaWiki MediaWiki=1.21.3
MediaWiki MediaWiki=1.21.4
MediaWiki MediaWiki=1.21.5
MediaWiki MediaWiki=1.21.6
MediaWiki MediaWiki=1.21.7
MediaWiki MediaWiki=1.21.8
MediaWiki MediaWiki=1.21.9
Remediation
Event History
Jun 6, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Data Sourced
via NVD·02:55 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-3966?
CVE-2014-3966 has a medium severity level as it allows XSS attacks that can lead to unauthorized access or data manipulation.
2
How do I fix CVE-2014-3966?
To fix CVE-2014-3966, upgrade MediaWiki to version 1.19.16, 1.21.10, or 1.22.7 or later.
3
What versions of MediaWiki are affected by CVE-2014-3966?
CVE-2014-3966 affects MediaWiki versions before 1.19.16, 1.21.x before 1.21.10, and 1.22.x before 1.22.7.
4
What type of vulnerability is CVE-2014-3966?
CVE-2014-3966 is a cross-site scripting (XSS) vulnerability.
5
Can CVE-2014-3966 be exploited remotely?
Yes, CVE-2014-3966 can be exploited remotely by injecting arbitrary web scripts or HTML.