CVE-2014-2242
- State
- Published
- Severity
- Not scored
- Published
- Mar 2, 2014
- Updated
- Aug 6, 2024
- Reserved
- Feb 28, 2014
Description
includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.
Scores
The record has no CVSS score.
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
n/an/a |
|
References
- 65910vdb-entry
- [oss-security] 20140228 CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 releasemailing-list
- https://gerrit.wikimedia.org/r/#/q/7d923a6b53f7fbcb0cbc3a19797d741bf6f440eb%2Cn%2Cz
- [mediawiki-announce] 20140228 MediaWiki Security and Maintenance Releases: 1.22.3, 1.21.6 and 1.19.12mailing-list
- https://bugzilla.wikimedia.org/show_bug.cgi?id=60771
- [oss-security] 20140301 Re: CVE requests: MediaWiki 1.22.3, 1.21.6 and 1.19.12 releasemailing-list
- https://bugzilla.redhat.com/show_bug.cgi?id=1071135
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.