MGASA-2014-0555
Updated mediawiki packages fix security vulnerabilities
Updated mediawiki packages fix security vulnerabilities:
In MediaWiki before 1.23.8, thumb.php outputs wikitext message as raw HTML, which could lead to cross-site scripting. Permission to edit MediaWiki namespace is required to exploit this.
In MediaWiki before 1.23.8, a malicious site can bypass CORS restrictions in $wgCrossSiteAJAXdomains in API calls if it only included an allowed domain as part of its name.
What each source reports
OSV No score
Updated mediawiki packages fix security vulnerabilities
Updated mediawiki packages fix security vulnerabilities:
In MediaWiki before 1.23.8, thumb.php outputs wikitext message as raw HTML, which could lead to cross-site scripting. Permission to edit MediaWiki namespace is required to exploit this.
In MediaWiki before 1.23.8, a malicious site can bypass CORS restrictions in $wgCrossSiteAJAXdomains in API calls if it only included an allowed domain as part of its name.
- Record
MGASA-2014-0555- Updated
- 2026-11-02
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiMageia:4 |
before 1.23.8-1.mga4 | 1.23.8-1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| first indexed | OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
MGASA-2014-0555 is a vulnerability with no CVSS score yet in mediawiki, published December 26, 2014. No source lists public exploit code. Fixed in mediawiki 1.23.8-1.mga4.