{"id":"CVE-2014-2242","aliases":["DEBIAN-CVE-2014-2242","EUVD-2014-2281","GHSA-xvhv-fm6p-g8q4","MGASA-2014-0124","UBUNTU-CVE-2014-2242"],"status":"published","title":"includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and...","description":"includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02441,"percentile":0.84412,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2014-03-02T02:00:00Z","modified":"2026-10-23T15:47:34Z","fixes":[{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.19.12+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.19.12+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.19.12+dfsg-1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.12+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.12+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.12+dfsg-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-1.mga3"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-1.mga4"}]}],"bundled":3}],"products":[{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"http://www.securityfocus.com/bid/65910","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://openwall.com/lists/oss-security/2014/02/28/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"https://gerrit.wikimedia.org/r/#/q/7d923a6b53f7fbcb0cbc3a19797d741bf6f440eb%2Cn%2Cz","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","advisory","fix","web","report"]},{"url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=60771","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","report"]},{"url":"http://openwall.com/lists/oss-security/2014/03/01/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1071135","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2242"},{"url":"https://gerrit.wikimedia.org/r/#/q/7d923a6b53f7fbcb0cbc3a19797d741bf6f440eb,n,z","tags":["report"]},{"url":"https://github.com/advisories/GHSA-xvhv-fm6p-g8q4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-2242","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0124.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-2242","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-2242","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-2242","description":"includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.","status":"published","published":"2014-03-02T02:00:00Z","modified":"2024-08-06T10:06:00.324Z","updated_at":"2026-11-02T14:33:43.883586Z"}],"euvd":[{"id":"EUVD-2014-2281","description":"includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.","status":"published","published":"2014-03-02T02:00:00Z","modified":"2024-08-06T10:06:00Z","updated_at":"2026-11-03T01:57:14.847023Z"}],"ghsa":[{"id":"GHSA-xvhv-fm6p-g8q4","title":"includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and...","description":"includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.","status":"published","published":"2022-05-17T03:57:42Z","modified":"2025-04-12T12:32:05Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:01:16.95233Z"}],"nvd":[{"id":"CVE-2014-2242","description":"includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.","status":"published","published":"2014-03-02T04:57:25.887Z","modified":"2026-06-17T00:06:16.763Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:53.330367Z"}],"osv":[{"id":"CVE-2014-2242","description":"includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.","status":"published","published":"2014-03-02T04:57:25Z","modified":"2026-04-16T06:25:57.039036362Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-2242","description":"includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.","status":"published","published":"2014-03-02T04:57:25.887Z","modified":"2026-10-23T15:47:34.584096906Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"MGASA-2014-0124","title":"Updated mediawiki packages fix multiple vulnerabilities","description":"Updated mediawiki packages fix security vulnerabilities:\n\nMediaWiki before 1.22.3 does not block unsafe namespaces, such as a W3C XHTML\nnamespace, in uploaded SVG files.  Some client software may use these\nnamespaces in a way that results in XSS.  This was fixed by disallowing\nuploading SVG files using non-whitelisted namespaces (CVE-2014-2242).\n\nMediaWiki before 1.22.3 performs token comparison that may be vulnerable to\ntiming attacks.  This was fixed by making token comparison use constant time\n(CVE-2014-2243).\n\nMediaWiki before 1.22.3 could allow an attacker to perform XSS attacks, due\nto flaw with link handling in api.php.  This was fixed such that it won't\nfind links in the middle of api.php links (CVE-2014-2244).\n","status":"published","published":"2014-03-07T20:12:00Z","modified":"2026-04-16T06:22:33.29325174Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2014-2242","description":"includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.","status":"withdrawn","published":"2014-03-02T04:57:00Z","modified":"2025-07-16T07:31:50.53481Z","updated_at":"2026-11-02T15:54:07.855521Z"}]}}