CVE-2014-5242: XSS

Published Aug 22, 2014

Updated

Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value.

Affected Software

11 affected components

MediaWiki MediaWiki=1.22.0

MediaWiki MediaWiki=1.22.1

MediaWiki MediaWiki=1.22.2

MediaWiki MediaWiki=1.22.3

MediaWiki MediaWiki=1.22.4

MediaWiki MediaWiki=1.22.5

MediaWiki MediaWiki=1.22.6

MediaWiki MediaWiki=1.22.7

MediaWiki MediaWiki=1.22.8

MediaWiki MediaWiki=1.23.0

MediaWiki MediaWiki=1.23.1

Event History

Aug 22, 2014

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2014-5242?

CVE-2014-5242 is classified as a high severity vulnerability due to its potential to allow remote attackers to execute arbitrary scripts.

How do I fix CVE-2014-5242?

To fix CVE-2014-5242, upgrade your MediaWiki installation to version 1.22.9 or 1.23.2 or later.

Which versions of MediaWiki are affected by CVE-2014-5242?

CVE-2014-5242 affects MediaWiki versions 1.22.0 through 1.22.8 and 1.23.0 through 1.23.1.

What type of vulnerability is CVE-2014-5242?

CVE-2014-5242 is a cross-site scripting (XSS) vulnerability.

Can CVE-2014-5242 be exploited remotely?

Yes, CVE-2014-5242 can be exploited remotely by attackers through specific vectors.