CVE-2014-9475
Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1...
CVE-2014-9475 is a low vulnerability (CVSS 3.5) in Mediawiki, published December 23, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.45%, the 73rd percentile. Fixed in mediawiki 1:1.19.20+dfsg-2.2.
- Severity
- 3.5 LowCVSS 2.0, NVD
- Exploit chance
- 1.45%EPSS, 73rd percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
1:1.19.20+dfsg-2.2mediawiki +3 more
Description
Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiDebian:12 | before 1:1.19.20+dfsg-2.2 | 1:1.19.20+dfsg-2.2 |
mediawikiDebian:13 | before 1:1.19.20+dfsg-2.2 | 1:1.19.20+dfsg-2.2 |
mediawikiDebian:14 | before 1:1.19.20+dfsg-2.2 | 1:1.19.20+dfsg-2.2 |
mediawikiDebian:7 | before 1:1.19.20+dfsg-0+deb7u3, plus listed versions 1:1.19.10+dfsg-11:1.19.11+dfsg-0+deb7u11:1.19.11+dfsg-11:1.19.12+dfsg-11:1.19.13+dfsg-1 Show 26 moreShow less1:1.19.14+dfsg-0+deb7u11:1.19.14+dfsg-0+deb7u21:1.19.14+dfsg-11:1.19.15+dfsg-0+deb7u11:1.19.15+dfsg-11:1.19.15+dfsg-21:1.19.16+dfsg-0+deb7u11:1.19.16+dfsg-11:1.19.17+dfsg-11:1.19.18+dfsg-0+deb7u11:1.19.18+dfsg-0.11:1.19.19+dfsg-0+deb7u11:1.19.19+dfsg-11:1.19.20+dfsg-0+deb7u11:1.19.20+dfsg-0+deb7u21:1.19.5-11:1.19.5-1+deb7u11:1.19.6-11:1.19.7+dfsg-11:1.19.7+dfsg-1.11:1.19.8+dfsg-11:1.19.8+dfsg-21:1.19.8+dfsg-2.11:1.19.8+dfsg-2.21:1.19.9+dfsg-11:1.19.9+dfsg-2 | 1:1.19.20+dfsg-0+deb7u3 |
What each source reports
NVD Score used
Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message.
- Record
CVE-2014-9475- CVSS 2.0
- 3.5 Low
AV:N/AC:M/Au:S/C:N/I:P/A:N - Weakness
- CWE-79
- Updated
- 2026-11-02
CVE ListNo score
Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message.
- Record
CVE-2014-9475- Updated
- 2026-11-02
EUVDEUVD-2014-9294No score
Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message.
- Record
EUVD-2014-9294- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-68mq-r5mx-h5r5No score
Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1...
Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message.
- Record
GHSA-68mq-r5mx-h5r5- Weakness
- CWE-79
- Updated
- 2026-11-02
OSVNo score
Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message.
- Record
CVE-2014-9475- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9475No score
Cross-site scripting (XSS) vulnerability in thumb.php in MediaWiki before 1.19.23, 1.2x before 1.22.15, 1.23.x before 1.23.8, and 1.24.x before 1.24.1 allows remote authenticated users to inject arbitrary web script or HTML via a wikitext message.
- Record
DEBIAN-CVE-2014-9475- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
debian.org/security/2014/dsa-3110
openwall.com/lists/oss-security/2015/01/03/13
mandriva.com/security/advisories?name=MDVSA-2015:006
lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html
nvd.nist.gov/vuln/detail/CVE-2014-9475
github.com/advisories/GHSA-68mq-r5mx-h5r5
security-tracker.debian.org/tracker/CVE-2014-9475