CVE-2014-9475: XSS
Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message.
Other sources
Upstream changelog mentions a whole bunch of vulnerabilities fixed in latest releases: (bug T76686) [SECURITY] thumb.php outputs wikitext message as raw HTML, which could lead to xss. Permission to edit MediaWiki namespace is required to exploit this. (bug T77028) [SECURITY] Malicious site can bypass CORS restrictions in $wgCrossSiteAJAXdomains in API calls if it only included an allowed domain as part of its name.
== Security fixes in extensions == (bug T77624) [SECURITY] Extension:Listings: missing validation in the 'name' and 'url' parameters. (bug T73111) [SECURITY] Extension:ExpandTemplates: parses user input as wikitext and shows a preview, yet it fails to add an edit token to the form and check it. This can be exploited as an XSS when $wgRawHtml = true. Note this only affects the 1.19/1.22 branches. (bug T76195) [SECURITY] Extension:TemplateSandbox: Special:TemplateSandbox needs edit token when raw HTML is allowed (bug T69180) [SECURITY] Extension:Hovercards: XSS in text extracts. (bug T73167) [SECURITY] Extension:Scribunto allows cross-origin leakage of data from a wiki through timing (bug T71209) [SECURITY] Extension:TimedMediaHandler: Patch getid3 library for CVE-2014-2053.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9475?
CVE-2014-9475 is considered a medium severity cross-site scripting vulnerability.
How do I fix CVE-2014-9475?
To fix CVE-2014-9475, upgrade MediaWiki to version 1.24.1, 1.23.8, 1.22.15, or 1.19.23 or later.
What products are affected by CVE-2014-9475?
CVE-2014-9475 affects MediaWiki versions before 1.19.23, 1.22.15, 1.23.8, and 1.24.1.
Can unprivileged users exploit CVE-2014-9475?
Yes, remote authenticated users can exploit CVE-2014-9475 to inject arbitrary web scripts.
What is the nature of the vulnerability in CVE-2014-9475?
CVE-2014-9475 is a cross-site scripting (XSS) vulnerability that allows script injection via wikitext.