{"id":"CVE-2014-5242","aliases":["EUVD-2014-5140","GHSA-c6g2-67vp-v3m9","MGASA-2014-0309"],"status":"published","title":"Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22...","description":"Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.02074,"percentile":0.81597,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-79"],"published":"2014-08-05T20:08:48Z","modified":"2026-06-17T00:11:15Z","affected":[{"source":"osv","ecosystem":"Mageia:3","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.2-1.mga3"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.2-1.mga4"}]}],"bundled":3}],"products":[{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-July/000157.html","tags":["mailing-list","x_refsource_MLIST","x_transferred"]},{"url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=66608","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:153","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"]},{"url":"http://www.securityfocus.com/bid/69135","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"http://openwall.com/lists/oss-security/2014/08/14/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://advisories.mageia.org/MGASA-2014-0309.html","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5242"},{"url":"https://github.com/advisories/GHSA-c6g2-67vp-v3m9"},{"url":"https://advisories.mageia.org/MGASA-2014-0309.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13833","tags":["report"]},{"url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-July/000157.html","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-5242","description":"Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value.","status":"published","published":"2014-08-22T17:00:00Z","modified":"2024-08-06T11:41:48.075Z","updated_at":"2026-11-02T14:33:41.889751Z"}],"euvd":[{"id":"EUVD-2014-5140","description":"Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value.","status":"published","published":"2014-08-22T17:00:00Z","modified":"2024-08-06T11:41:48Z","updated_at":"2026-11-03T01:57:03.789124Z"}],"ghsa":[{"id":"GHSA-c6g2-67vp-v3m9","title":"Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22...","description":"Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value.","status":"published","published":"2022-05-17T04:08:13Z","modified":"2023-01-28T05:01:07Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:43:29.335465Z"}],"nvd":[{"id":"CVE-2014-5242","description":"Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value.","status":"published","published":"2014-08-22T17:55:02.86Z","modified":"2026-06-17T00:11:15.743Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:02:55.19899Z"}],"osv":[{"id":"MGASA-2014-0309","title":"Updated mediawiki packages fix security vulnerabilities","description":"MediaWiki before 1.23.2 is vulnerable to JSONP injection in Flash\n(CVE-2014-5241), XSS in mediawiki.page.image.pagination.js (CVE-2014-5242),\nand clickjacking between OutputPage and ParserOutput (CVE-2014-5243).\n\nThis update provides MediaWiki 1.23.2, fixing these and other issues.\n","status":"published","published":"2014-08-05T20:08:48Z","modified":"2026-04-16T06:24:53.253706881Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}