CVE-2014-9479: XSS
Published Jan 16, 2015
·Updated
Cross-site scripting (XSS) vulnerability in the preview in the TemplateSandbox extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via the text parameter to Special:TemplateSandbox.
Affected Software
46 affected components
MediaWiki MediaWiki<=1.19.22
MediaWiki MediaWiki=1.20
MediaWiki MediaWiki=1.20.1
MediaWiki MediaWiki=1.20.2
MediaWiki MediaWiki=1.20.3
MediaWiki MediaWiki=1.20.4
MediaWiki MediaWiki=1.20.5
MediaWiki MediaWiki=1.20.6
MediaWiki MediaWiki=1.20.7
MediaWiki MediaWiki=1.20.8
MediaWiki MediaWiki=1.21
MediaWiki MediaWiki=1.21.1
MediaWiki MediaWiki=1.21.2
MediaWiki MediaWiki=1.21.3
MediaWiki MediaWiki=1.21.4
MediaWiki MediaWiki=1.21.5
MediaWiki MediaWiki=1.21.6
MediaWiki MediaWiki=1.21.7
MediaWiki MediaWiki=1.21.8
MediaWiki MediaWiki=1.21.9
MediaWiki MediaWiki=1.21.10
MediaWiki MediaWiki=1.21.11
MediaWiki MediaWiki=1.22.0
MediaWiki MediaWiki=1.22.1
MediaWiki MediaWiki=1.22.2
MediaWiki MediaWiki=1.22.3
MediaWiki MediaWiki=1.22.4
MediaWiki MediaWiki=1.22.5
MediaWiki MediaWiki=1.22.6
MediaWiki MediaWiki=1.22.7
MediaWiki MediaWiki=1.22.8
MediaWiki MediaWiki=1.22.9
MediaWiki MediaWiki=1.22.10
MediaWiki MediaWiki=1.22.11
MediaWiki MediaWiki=1.22.12
MediaWiki MediaWiki=1.22.13
MediaWiki MediaWiki=1.22.14
MediaWiki MediaWiki=1.23.0
MediaWiki MediaWiki=1.23.1
MediaWiki MediaWiki=1.23.2
MediaWiki MediaWiki=1.23.3
MediaWiki MediaWiki=1.23.4
MediaWiki MediaWiki=1.23.5
MediaWiki MediaWiki=1.23.6
MediaWiki MediaWiki=1.23.7
MediaWiki MediaWiki=1.24.0
Event History
Jan 16, 2015
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9479?
CVE-2014-9479 has a moderate severity level due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2014-9479?
To fix CVE-2014-9479, upgrade MediaWiki to a version that is later than 1.24.0.
3
Which versions of MediaWiki are affected by CVE-2014-9479?
CVE-2014-9479 affects MediaWiki versions up to and including 1.24.0.
4
What type of vulnerability is CVE-2014-9479?
CVE-2014-9479 is a cross-site scripting (XSS) vulnerability.
5
Can CVE-2014-9479 be exploited by remote attackers?
Yes, CVE-2014-9479 can be exploited by remote attackers to inject arbitrary web scripts or HTML.