CVE-2014-9480: XSS
Published Jan 16, 2015
·Updated
Cross-site scripting (XSS) vulnerability in the Hovercards extension for MediaWiki allows remote attackers to inject arbitrary web script or HTML via vectors related to text extracts.
Affected Software
46 affected components
MediaWiki MediaWiki<=1.19.22
MediaWiki MediaWiki=1.20
MediaWiki MediaWiki=1.20.1
MediaWiki MediaWiki=1.20.2
MediaWiki MediaWiki=1.20.3
MediaWiki MediaWiki=1.20.4
MediaWiki MediaWiki=1.20.5
MediaWiki MediaWiki=1.20.6
MediaWiki MediaWiki=1.20.7
MediaWiki MediaWiki=1.20.8
MediaWiki MediaWiki=1.21
MediaWiki MediaWiki=1.21.1
MediaWiki MediaWiki=1.21.2
MediaWiki MediaWiki=1.21.3
MediaWiki MediaWiki=1.21.4
MediaWiki MediaWiki=1.21.5
MediaWiki MediaWiki=1.21.6
MediaWiki MediaWiki=1.21.7
MediaWiki MediaWiki=1.21.8
MediaWiki MediaWiki=1.21.9
MediaWiki MediaWiki=1.21.10
MediaWiki MediaWiki=1.21.11
MediaWiki MediaWiki=1.22.0
MediaWiki MediaWiki=1.22.1
MediaWiki MediaWiki=1.22.2
MediaWiki MediaWiki=1.22.3
MediaWiki MediaWiki=1.22.4
MediaWiki MediaWiki=1.22.5
MediaWiki MediaWiki=1.22.6
MediaWiki MediaWiki=1.22.7
MediaWiki MediaWiki=1.22.8
MediaWiki MediaWiki=1.22.9
MediaWiki MediaWiki=1.22.10
MediaWiki MediaWiki=1.22.11
MediaWiki MediaWiki=1.22.12
MediaWiki MediaWiki=1.22.13
MediaWiki MediaWiki=1.22.14
MediaWiki MediaWiki=1.23.0
MediaWiki MediaWiki=1.23.1
MediaWiki MediaWiki=1.23.2
MediaWiki MediaWiki=1.23.3
MediaWiki MediaWiki=1.23.4
MediaWiki MediaWiki=1.23.5
MediaWiki MediaWiki=1.23.6
MediaWiki MediaWiki=1.23.7
MediaWiki MediaWiki=1.24.0
Event History
Jan 16, 2015
CVE Published
via MITRE·04:00 PM
Data Sourced
via MITRE·04:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-9480?
CVE-2014-9480 is classified as a medium severity vulnerability due to its potential for cross-site scripting attacks.
2
How do I fix CVE-2014-9480?
To fix CVE-2014-9480, upgrade MediaWiki to versions 1.24.0 or later, which contain the necessary patches.
3
Which versions of MediaWiki are affected by CVE-2014-9480?
CVE-2014-9480 affects MediaWiki versions up to 1.23.7, including several versions from 1.19.22 to 1.23.7.
4
Can CVE-2014-9480 be exploited remotely?
Yes, CVE-2014-9480 can be exploited remotely by attackers to inject arbitrary web scripts or HTML.
5
What types of attacks can CVE-2014-9480 enable?
CVE-2014-9480 enables cross-site scripting (XSS) attacks, which could lead to data theft or session hijacking.