{"id":"CVE-2014-2244","aliases":["EUVD-2014-2283","GHSA-52xg-w6c8-rp56","MGASA-2014-0124","UBUNTU-CVE-2014-2244"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase...","description":"Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02071,"percentile":0.81568,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2014-03-02T02:00:00Z","modified":"2026-06-17T00:06:17Z","affected":[{"source":"osv","ecosystem":"Mageia:3","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-1.mga3"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.22.3-1.mga4"}]}],"bundled":3}],"products":[{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"http://openwall.com/lists/oss-security/2014/02/28/1","tags":["mailing-list","x_refsource_MLIST","x_transferred","report"]},{"url":"http://www.securityfocus.com/bid/65906","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Patch","Vendor Advisory","web","report"]},{"url":"https://gerrit.wikimedia.org/r/#/q/Idf985e4e69c2f11778a8a90503914678441cb3fb%2Cn%2Cz","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=61362","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","report"]},{"url":"http://openwall.com/lists/oss-security/2014/03/01/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1071139","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2244"},{"url":"https://gerrit.wikimedia.org/r/#/q/Idf985e4e69c2f11778a8a90503914678441cb3fb,n,z","tags":["report"]},{"url":"https://github.com/advisories/GHSA-52xg-w6c8-rp56"},{"url":"https://advisories.mageia.org/MGASA-2014-0124.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12931","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-2244","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-2244","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-2244","description":"Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php.","status":"published","published":"2014-03-02T02:00:00Z","modified":"2024-08-06T10:06:00.222Z","updated_at":"2026-11-02T14:33:43.566796Z"}],"euvd":[{"id":"EUVD-2014-2283","description":"Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php.","status":"published","published":"2014-03-02T02:00:00Z","modified":"2024-08-06T10:06:00Z","updated_at":"2026-11-03T01:57:14.847023Z"}],"ghsa":[{"id":"GHSA-52xg-w6c8-rp56","title":"Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase...","description":"Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php.","status":"published","published":"2022-05-17T04:10:13Z","modified":"2025-04-12T12:32:05Z","cwes":["CWE-79"],"updated_at":"2026-11-02T15:01:16.95233Z"}],"nvd":[{"id":"CVE-2014-2244","description":"Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php.","status":"published","published":"2014-03-02T04:57:25.95Z","modified":"2026-06-17T00:06:17.037Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:53.330367Z"}],"osv":[{"id":"MGASA-2014-0124","title":"Updated mediawiki packages fix multiple vulnerabilities","description":"Updated mediawiki packages fix security vulnerabilities:\n\nMediaWiki before 1.22.3 does not block unsafe namespaces, such as a W3C XHTML\nnamespace, in uploaded SVG files.  Some client software may use these\nnamespaces in a way that results in XSS.  This was fixed by disallowing\nuploading SVG files using non-whitelisted namespaces (CVE-2014-2242).\n\nMediaWiki before 1.22.3 performs token comparison that may be vulnerable to\ntiming attacks.  This was fixed by making token comparison use constant time\n(CVE-2014-2243).\n\nMediaWiki before 1.22.3 could allow an attacker to perform XSS attacks, due\nto flaw with link handling in api.php.  This was fixed such that it won't\nfind links in the middle of api.php links (CVE-2014-2244).\n","status":"published","published":"2014-03-07T20:12:00Z","modified":"2026-04-16T06:22:33.29325174Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"UBUNTU-CVE-2014-2244","description":"Cross-site scripting (XSS) vulnerability in the formatHTML function in includes/api/ApiFormatBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 allows remote attackers to inject arbitrary web script or HTML via a crafted string located after http:// in the text parameter to api.php.","status":"withdrawn","published":"2014-03-02T04:57:00Z","modified":"2025-07-16T08:10:59.528947Z","updated_at":"2026-11-02T15:54:07.855521Z"}]}}