CVE-2014-9478: XSS
Cross-site scripting (XSS) vulnerability in the preview in the ExpandTemplates extension for MediaWiki, when $wgRawHTML is set to true, allows remote attackers to inject arbitrary web script or HTML via the wpInput parameter to the Special:ExpandTemplates page.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9478?
The severity of CVE-2014-9478 is categorized as medium due to its potential for cross-site scripting (XSS) attacks.
How do I fix CVE-2014-9478?
To fix CVE-2014-9478, it is recommended to update MediaWiki to version 1.24.0 or later, ensuring $wgRawHTML is set to false.
Which versions of MediaWiki are affected by CVE-2014-9478?
CVE-2014-9478 affects MediaWiki versions up to 1.23.7, including several versions of 1.19.x, 1.20.x, 1.21.x, and 1.22.x.
What kind of attack can be performed through CVE-2014-9478?
CVE-2014-9478 allows attackers to perform cross-site scripting (XSS), injecting arbitrary scripts via the wpInput parameter.
What are the implications of CVE-2014-9478 on web applications?
The implications of CVE-2014-9478 include the potential for remote attackers to compromise user sessions and steal sensitive data.