CVE-2014-5243
MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not...
MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
Exploit likelihood
What each source reports
NVD Score used
MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
- Record
CVE-2014-5243- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
- Record
CVE-2014-5243- Updated
- 2026-11-02
EUVDEUVD-2014-5141 No score
MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
- Record
EUVD-2014-5141- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p79q-phv9-m8c4 No score
MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not...
MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
- Record
GHSA-p79q-phv9-m8c4- Weakness
- CWE-20
- Updated
- 2026-11-02
OSV No score
MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
- Record
CVE-2014-5243- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-5243 No score
MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.
- Record
DEBIAN-CVE-2014-5243- Updated
- 2026-11-02
OSVMGASA-2014-0309 No score
Updated mediawiki packages fix security vulnerabilities
MediaWiki before 1.23.2 is vulnerable to JSONP injection in Flash (CVE-2014-5241), XSS in mediawiki.page.image.pagination.js (CVE-2014-5242), and clickjacking between OutputPage and ParserOutput (CVE-2014-5243).
This update provides MediaWiki 1.23.2, fixing these and other issues.
- Record
MGASA-2014-0309- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiDebian:12 |
before 1:1.19.18+dfsg-0.1 | 1:1.19.18+dfsg-0.1 |
mediawikiDebian:13 |
before 1:1.19.18+dfsg-0.1 | 1:1.19.18+dfsg-0.1 |
mediawikiDebian:14 |
before 1:1.19.18+dfsg-0.1 | 1:1.19.18+dfsg-0.1 |
mediawikiDebian:7 |
before 1:1.19.18+dfsg-0+deb7u1, plus listed versions 1:1.19.10+dfsg-11:1.19.11+dfsg-0+deb7u11:1.19.11+dfsg-11:1.19.12+dfsg-11:1.19.13+dfsg-1 Show 20 moreShow less1:1.19.14+dfsg-0+deb7u11:1.19.14+dfsg-0+deb7u21:1.19.14+dfsg-11:1.19.15+dfsg-0+deb7u11:1.19.15+dfsg-11:1.19.15+dfsg-21:1.19.16+dfsg-0+deb7u11:1.19.16+dfsg-11:1.19.17+dfsg-11:1.19.5-11:1.19.5-1+deb7u11:1.19.6-11:1.19.7+dfsg-11:1.19.7+dfsg-1.11:1.19.8+dfsg-11:1.19.8+dfsg-21:1.19.8+dfsg-2.11:1.19.8+dfsg-2.21:1.19.9+dfsg-11:1.19.9+dfsg-2 |
1:1.19.18+dfsg-0+deb7u1 |
mediawikiMageia:3 |
before 1.23.2-1.mga3 | 1.23.2-1.mga3 |
mediawikiMageia:4 |
before 1.23.2-1.mga4 | 1.23.2-1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-5243 is a medium vulnerability (CVSS 4.3) in Mediawiki, published August 5, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.77%, the 78th percentile. Fixed in mediawiki 1:1.19.18+dfsg-0.1.