CVE-2014-2853
Cross-site scripting vulnerability in includes/actions/InfoAction.php
Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.
Exploit likelihood
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.
- Record
CVE-2014-2853- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE List No score
Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.
- Record
CVE-2014-2853- Updated
- 2026-11-02
EUVDEUVD-2022-2799 No score
Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.
- Record
EUVD-2022-2799- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-6h86-9r5g-f2h5 No score
Cross-site scripting vulnerability in includes/actions/InfoAction.php
Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.
- Record
GHSA-6h86-9r5g-f2h5- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVGHSA-6h86-9r5g-f2h5 No score
Cross-site scripting vulnerability in includes/actions/InfoAction.php
Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.
- Record
GHSA-6h86-9r5g-f2h5- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVMGASA-2014-0197 No score
Updated mediawiki packages fix security vulnerability
Updated mediawiki packages fix security vulnerability:
XSS vulnerability in MediaWiki before 1.22.6, where if the default sort key is set to a string containing a script, the script will be executed when the page is viewed using the info action (CVE-2014-2853).
- Record
MGASA-2014-0197- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawiki/corePackagist |
before 1.21.9 | 1.21.9 |
mediawiki/corePackagist |
1.22.0 up to 1.22.6 | 1.22.6 |
mediawiki/corePackagist |
before 1.21.9, plus listed versions 1.20.31.20.41.20.51.20.61.20.7 Show 10 moreShow less1.20.81.21.01.21.11.21.21.21.31.21.41.21.51.21.61.21.71.21.8 |
1.21.9 |
mediawikiMageia:3 |
before 1.22.6-1.mga3 | 1.22.6-1.mga3 |
mediawikiMageia:4 |
before 1.22.6-1.mga4 | 1.22.6-1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-2853 is a medium vulnerability (CVSS 4.3) in Mediawiki, published April 28, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 2.39%, the 84th percentile. Fixed in mediawiki/core 1.21.9.
References
securityfocus.com/bid/67068
securitytracker.com/id/1030161
secunia.com/advisories/58262
github.com/wikimedia/mediawiki-core/commit/0b695ae09aada343ab59be4a3c9963995a1143b6
lists.wikimedia.org/pipermail/mediawiki-announce/2014-April/000149.html
mediawiki.org/wiki/Release_notes/1.22
Show 8 moreShow less
bugzilla.wikimedia.org/show_bug.cgi?id=63251
bugzilla.redhat.com/show_bug.cgi?id=1091967
nvd.nist.gov/vuln/detail/CVE-2014-2853
advisories.mageia.org/MGASA-2014-0197.html
bugs.mageia.org/show_bug.cgi?id=13272