CVE-2017-8814
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2...
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk."
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
NVD Score used
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk."
- Record
CVE-2017-8814- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
CVE List No score
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk."
- Record
CVE-2017-8814- Updated
- 2026-11-02
EUVDEUVD-2017-17757 No score
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk."
- Record
EUVD-2017-17757- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-x2m4-j2wv-q4h4
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2...
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk."
- Record
GHSA-x2m4-j2wv-q4h4- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk."
- Record
CVE-2017-8814- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2017-8814
The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk."
- Record
DEBIAN-CVE-2017-8814- CVSS 3.0
- 7.5 High
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N - Updated
- 2026-11-02
OSVMGASA-2017-0429 No score
Updated mediawiki packages fix security vulnerabilities
XSS when $wgShowExceptionDetails = false and browser sends non-standard url escaping (CVE-2017-8808).
Reflected File Download from api.php (CVE-2017-8809).
On private wikis, login form shouldn't distinguish between login failure due to bad username and bad password (CVE-2017-8810).
It's possible to mangle HTML via raw message parameter expansion (CVE-2017-8811).
The id attribute on headlines allow raw > (CVE-2017-8812).
Language converter can be tricked into replacing text inside tags by adding a lot of junk after the rule definition (CVE-2017-8814).
Language converter: unsafe attribute injection via glossary rules (CVE-2017-8815).
composer.json has require-dev versions of PHPUnit with known security issues (CVE-2017-9841).
Note that MediaWiki 1.23.x on Mageia 5 is no longer supported. Those using the mediawiki package on Mageia 5 should upgrade to Mageia 6.
- Record
MGASA-2017-0429- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiDebian:12 |
before 1:1.27.4-1 | 1:1.27.4-1 |
mediawikiDebian:13 |
before 1:1.27.4-1 | 1:1.27.4-1 |
mediawikiDebian:14 |
before 1:1.27.4-1 | 1:1.27.4-1 |
mediawikiDebian:9 From an advisory covering 7 CVEs |
before 1:1.27.4-1~deb9u1, plus listed versions 1:1.27.3-11:1.27.4-1~bpo8+1 |
1:1.27.4-1~deb9u1 |
mediawikiMageia:6 From an advisory covering 8 CVEs |
before 1.27.4-1.mga6 | 1.27.4-1.mga6 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2017-8814 is a high vulnerability (CVSS 7.5) in Mediawiki, published November 15, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.61%, the 76th percentile. Fixed in mediawiki 1:1.27.4-1.
References
securitytracker.com/id/1039812
lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.html
debian.org/security/2017/dsa-4036
nvd.nist.gov/vuln/detail/CVE-2017-8814
github.com/advisories/GHSA-x2m4-j2wv-q4h4
security-tracker.debian.org/tracker/CVE-2017-8814
advisories.mageia.org/MGASA-2017-0429.html
bugs.mageia.org/show_bug.cgi?id=22038