CVE-2014-7199: XSS
Published Sep 30, 2014
·Updated
Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.19, 1.22.x before 1.22.11, and 1.23.x before 1.23.4 allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.
Affected Software
37 affected components
MediaWiki MediaWiki=1.19
MediaWiki MediaWiki=1.19-beta_1
MediaWiki MediaWiki=1.19-beta_2
MediaWiki MediaWiki=1.19.0
MediaWiki MediaWiki=1.19.1
MediaWiki MediaWiki=1.19.2
MediaWiki MediaWiki=1.19.3
MediaWiki MediaWiki=1.19.4
MediaWiki MediaWiki=1.19.5
MediaWiki MediaWiki=1.19.6
MediaWiki MediaWiki=1.19.7
MediaWiki MediaWiki=1.19.8
MediaWiki MediaWiki=1.19.9
MediaWiki MediaWiki=1.19.10
MediaWiki MediaWiki=1.19.11
MediaWiki MediaWiki=1.19.12
MediaWiki MediaWiki=1.19.13
MediaWiki MediaWiki=1.19.14
MediaWiki MediaWiki=1.19.15
MediaWiki MediaWiki=1.19.16
MediaWiki MediaWiki=1.19.17
MediaWiki MediaWiki=1.19.18
MediaWiki MediaWiki=1.22.0
MediaWiki MediaWiki=1.22.1
MediaWiki MediaWiki=1.22.2
MediaWiki MediaWiki=1.22.3
MediaWiki MediaWiki=1.22.4
MediaWiki MediaWiki=1.22.5
MediaWiki MediaWiki=1.22.6
MediaWiki MediaWiki=1.22.7
MediaWiki MediaWiki=1.22.8
MediaWiki MediaWiki=1.22.9
MediaWiki MediaWiki=1.22.10
MediaWiki MediaWiki=1.23.0
MediaWiki MediaWiki=1.23.1
MediaWiki MediaWiki=1.23.2
MediaWiki MediaWiki=1.23.3
Remediation
Patch Available
Event History
Sep 30, 2014
CVE Published
via MITRE·02:00 PM
Data Sourced
via MITRE·02:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-7199?
CVE-2014-7199 is considered a medium severity vulnerability due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2014-7199?
To fix CVE-2014-7199, upgrade your MediaWiki installation to version 1.19.19, 1.22.11, or 1.23.4 or later.
3
Which versions of MediaWiki are affected by CVE-2014-7199?
CVE-2014-7199 affects MediaWiki versions before 1.19.19, 1.22.x before 1.22.11, and 1.23.x before 1.23.4.
4
What type of vulnerability is CVE-2014-7199?
CVE-2014-7199 is a cross-site scripting (XSS) vulnerability.
5
Can CVE-2014-7199 be exploited remotely?
Yes, CVE-2014-7199 allows remote attackers to inject arbitrary web scripts or HTML via a crafted SVG file.