{"id":"CVE-2014-1610","aliases":["DEBIAN-CVE-2014-1610","DSA-2891-1","EUVD-2014-1685","GHSA-88m3-jgcp-453j","MGASA-2014-0113","UBUNTU-CVE-2014-1610"],"status":"published","title":"MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF...","description":"MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.","severity":{"version":"2.0","score":6,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.42777,"percentile":0.98722,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2014-01-30T23:00:00Z","modified":"2026-10-23T15:47:26Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/mediawiki_thumb","title":"MediaWiki Thumb.php Remote Command Execution","type":"exploit","platform":"PHP,Unix,Windows","date":"2014-01-28","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/mediawiki_thumb"},{"source":"exploitdb","id":"EDB-31329","title":"MediaWiki 1.22.1 PdfHandler - Remote Code Execution","type":"webapps","platform":"multiple","date":"2014-02-01","verified":true,"url":"https://www.exploit-db.com/exploits/31329"},{"source":"exploitdb","id":"EDB-31767","title":"MediaWiki - 'Thumb.php' Remote Command Execution (Metasploit)","type":"remote","platform":"multiple","date":"2014-02-19","verified":true,"url":"https://www.exploit-db.com/exploits/31767"}],"fixes":[{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.19.11+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.19.11+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.19.11+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.11+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.11+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.11+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.14+dfsg-0+deb7u1"}]}],"versions":["1:1.19.10+dfsg-1","1:1.19.11+dfsg-0+deb7u1","1:1.19.11+dfsg-1","1:1.19.12+dfsg-1","1:1.19.13+dfsg-1","1:1.19.5-1","1:1.19.5-1+deb7u1","1:1.19.6-1","1:1.19.7+dfsg-1","1:1.19.7+dfsg-1.1","1:1.19.8+dfsg-1","1:1.19.8+dfsg-2","1:1.19.8+dfsg-2.1","1:1.19.8+dfsg-2.2","1:1.19.9+dfsg-1","1:1.19.9+dfsg-2"],"bundled":11},{"source":"osv","ecosystem":"Debian:7","package":"mediawiki-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.5~deb7u1"}]}],"versions":["2.11","3.0","3.1","3.2","3.3","3.4","3~exp1","3~exp2","3~exp3"],"bundled":11},{"source":"osv","ecosystem":"Mageia:3","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-1.1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"mediawiki-ldapauthentication","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0f-1.1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"mediawiki-math","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1-1.1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.2-1.1.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"mediawiki-ldapauthentication","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0f-1.1.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"mediawiki-math","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.1-1.1.mga4"}]}],"bundled":5}],"products":[{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"http://www.exploit-db.com/exploits/31329/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html","tags":["x_refsource_MISC","x_transferred","advisory"]},{"url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=60339","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://secunia.com/advisories/57472","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"https://gerrit.wikimedia.org/r/#/c/110215/","tags":["x_refsource_MISC","x_transferred","web","report"]},{"url":"http://www.debian.org/security/2014/dsa-2891","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","advisory","web","report"]},{"url":"http://www.securitytracker.com/id/1029707","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/65223","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php","tags":["x_refsource_MISC","x_transferred","web","report"]},{"url":"http://www.osvdb.org/102631","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web"]},{"url":"https://bugzilla.wikimedia.org/attachment.cgi?id=14361\u0026action=diff","tags":["x_refsource_MISC","x_transferred","report"]},{"url":"https://bugzilla.wikimedia.org/attachment.cgi?id=14384\u0026action=diff","tags":["x_refsource_MISC","x_transferred","report"]},{"url":"http://secunia.com/advisories/56695","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Vendor Advisory","advisory","report"]},{"url":"https://gerrit.wikimedia.org/r/#/c/110069/","tags":["x_refsource_MISC","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://osvdb.org/102630","tags":["vdb-entry","x_refsource_OSVDB","x_transferred","web","report"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-1610"},{"url":"https://gerrit.wikimedia.org/r/#/c/110069"},{"url":"https://gerrit.wikimedia.org/r/#/c/110215"},{"url":"http://www.exploit-db.com/exploits/31329"},{"url":"https://github.com/advisories/GHSA-88m3-jgcp-453j"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-1610","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0113.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12337","tags":["report"]},{"url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000138.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-January/127027.html","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html","tags":["web"]},{"url":"http://www.mediawiki.org/wiki/Extension:GraphViz","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-1610","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-1610","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-1610","description":"MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.","status":"published","published":"2014-01-30T23:00:00Z","modified":"2024-08-06T09:50:09.575Z","updated_at":"2026-11-02T14:33:46.310517Z"}],"euvd":[{"id":"EUVD-2014-1685","description":"MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.","status":"published","published":"2014-01-30T23:00:00Z","modified":"2024-08-06T09:50:09Z","updated_at":"2026-11-03T01:57:17.345507Z"}],"ghsa":[{"id":"GHSA-88m3-jgcp-453j","title":"MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF...","description":"MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.","status":"published","published":"2022-05-17T03:54:53Z","modified":"2025-04-11T04:19:43Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:15.928203Z"}],"nvd":[{"id":"CVE-2014-1610","description":"MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.","status":"published","published":"2014-01-30T23:55:02.413Z","modified":"2026-06-17T00:05:16.833Z","cvss":[{"version":"2.0","score":6,"vector":"AV:N/AC:M/Au:S/C:P/I:P/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:53.330367Z"}],"osv":[{"id":"CVE-2014-1610","description":"MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.","status":"published","published":"2014-01-30T23:55:02Z","modified":"2026-04-16T06:26:30.066775815Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-1610","description":"MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.","status":"published","published":"2014-01-30T23:55:02.413Z","modified":"2026-10-23T15:47:26.427492557Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"DSA-2891-1","title":"mediawiki - security update","status":"published","published":"2014-03-30T00:00:00Z","modified":"2026-03-09T01:19:00.25627Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0113","title":"Updated mediawiki packages fix security vulnerabilities","description":"MediaWiki user Michael M reported that the fix for CVE-2013-4568 allowed\ninsertion of escaped CSS values which could pass the CSS validation checks,\nresulting in XSS (CVE-2013-6451).\n\nChris from RationalWiki reported that SVG files could be uploaded that\ninclude external stylesheets, which could lead to XSS when an XSL was used\nto include JavaScript (CVE-2013-6452).\n\nDuring internal review, it was discovered that MediaWiki's SVG sanitization\ncould be bypassed when the XML was considered invalid (CVE-2013-6453).\n\nDuring internal review, it was discovered that MediaWiki displayed some\ninformation about deleted pages in the log API, enhanced RecentChanges, and\nuser watchlists (CVE-2013-6472).\n\nNetanel Rubin from Check Point discovered a remote code execution\nvulnerability in MediaWiki's thumbnail generation for DjVu files. Internal\nreview also discovered similar logic in the PdfHandler extension, which\ncould be exploited in a similar way (CVE-2014-1610).\n\nMediaWiki has been updated to version 1.22.2, which fixes these issues, as\nwell as several others.\n\nAlso, the mediawiki-ldapauthentication and mediawiki-math extensions have\nbeen updated to newer versions that are compatible with MediaWiki 1.22.\n\nAdditionally, the mediawiki-graphviz extension has been obsoleted, due to\nthe fact that it is unmaintained upstream and is vulnerable to cross-site\nscripting attacks.\n\nNote: if you were using the \"instances\" feature in these packages to\nsupport multiple wiki instances, this feature has now been removed.  You\nwill need to maintain separate wiki instances manually.\n","status":"published","published":"2014-03-02T20:53:30Z","modified":"2026-04-16T06:22:54.196807544Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2014-1610","description":"MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.","status":"withdrawn","published":"2014-01-30T23:55:00Z","modified":"2025-07-16T08:10:58.228008Z","updated_at":"2026-11-02T15:54:07.855521Z"}]}}