CVE-2014-5241: CSRF
The JSONP endpoint in includes/api/ApiFormatJson.php in MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks, and obtain sensitive information, via a crafted OBJECT element with SWF content consistent with a restricted character set.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-5241?
CVE-2014-5241 has a medium severity rating due to its potential to facilitate cross-site request forgery attacks.
How do I fix CVE-2014-5241?
To fix CVE-2014-5241, upgrade to MediaWiki version 1.19.18, 1.22.9, or 1.23.2 or later.
What versions of MediaWiki are affected by CVE-2014-5241?
CVE-2014-5241 affects MediaWiki versions before 1.19.18, any version from 1.20.x to 1.22.x before 1.22.9, and any version in the 1.23.x series before 1.23.2.
What type of vulnerability is CVE-2014-5241?
CVE-2014-5241 is a cross-site request forgery (CSRF) vulnerability due to improper validation of JSONP callback parameters.
Can CVE-2014-5241 be exploited remotely?
Yes, CVE-2014-5241 can be exploited remotely by malicious attackers to manipulate site interactions without user consent.