{"id":"CVE-2014-5243","aliases":["DEBIAN-CVE-2014-5243","DSA-3011-1","EUVD-2014-5141","GHSA-p79q-phv9-m8c4","MGASA-2014-0309"],"status":"published","title":"MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not...","description":"MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.01774,"percentile":0.78339,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2014-08-05T20:08:48Z","modified":"2026-10-23T15:47:29Z","fixes":[{"ecosystem":"Debian:12","package":"mediawiki","fixed_in":["1:1.19.18+dfsg-0.1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"mediawiki","fixed_in":["1:1.19.18+dfsg-0.1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"mediawiki","fixed_in":["1:1.19.18+dfsg-0.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.18+dfsg-0.1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.18+dfsg-0.1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.18+dfsg-0.1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:1.19.18+dfsg-0+deb7u1"}]}],"versions":["1:1.19.10+dfsg-1","1:1.19.11+dfsg-0+deb7u1","1:1.19.11+dfsg-1","1:1.19.12+dfsg-1","1:1.19.13+dfsg-1","1:1.19.14+dfsg-0+deb7u1","1:1.19.14+dfsg-0+deb7u2","1:1.19.14+dfsg-1","1:1.19.15+dfsg-0+deb7u1","1:1.19.15+dfsg-1","1:1.19.15+dfsg-2","1:1.19.16+dfsg-0+deb7u1","1:1.19.16+dfsg-1","1:1.19.17+dfsg-1","1:1.19.5-1","1:1.19.5-1+deb7u1","1:1.19.6-1","1:1.19.7+dfsg-1","1:1.19.7+dfsg-1.1","1:1.19.8+dfsg-1","1:1.19.8+dfsg-2","1:1.19.8+dfsg-2.1","1:1.19.8+dfsg-2.2","1:1.19.9+dfsg-1","1:1.19.9+dfsg-2"],"bundled":2},{"source":"osv","ecosystem":"Mageia:3","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.2-1.mga3"}]}],"bundled":3},{"source":"osv","ecosystem":"Mageia:4","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.2-1.mga4"}]}],"bundled":3}],"products":[{"vendor":"mediawiki","product":"mediawiki"}],"references":[{"url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-July/000157.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://www.debian.org/security/2014/dsa-3011","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:153","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","advisory"]},{"url":"http://secunia.com/advisories/59738","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","advisory"]},{"url":"http://openwall.com/lists/oss-security/2014/08/14/5","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=65778","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"http://advisories.mageia.org/MGASA-2014-0309.html","tags":["x_refsource_CONFIRM","x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5243"},{"url":"https://github.com/advisories/GHSA-p79q-phv9-m8c4"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-5243","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0309.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13833","tags":["report"]},{"url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-July/000157.html","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-5243","description":"MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.","status":"published","published":"2014-08-22T17:00:00Z","modified":"2024-08-06T11:41:48.324Z","updated_at":"2026-11-02T14:33:41.889751Z"}],"euvd":[{"id":"EUVD-2014-5141","description":"MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.","status":"published","published":"2014-08-22T17:00:00Z","modified":"2024-08-06T11:41:48Z","updated_at":"2026-11-03T01:57:03.789124Z"}],"ghsa":[{"id":"GHSA-p79q-phv9-m8c4","title":"MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not...","description":"MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.","status":"published","published":"2022-05-17T03:05:47Z","modified":"2023-01-27T05:07:20Z","cwes":["CWE-20"],"updated_at":"2026-11-02T14:43:05.912007Z"}],"nvd":[{"id":"CVE-2014-5243","description":"MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.","status":"published","published":"2014-08-22T17:55:02.907Z","modified":"2026-06-17T00:11:15.87Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:55.19899Z"}],"osv":[{"id":"CVE-2014-5243","description":"MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.","status":"published","published":"2014-08-22T17:55:02Z","modified":"2026-04-16T06:25:02.963662594Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-5243","description":"MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an IFRAME protection mechanism for transcluded pages, which makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site.","status":"published","published":"2014-08-22T17:55:02.907Z","modified":"2026-10-23T15:47:29.003146544Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"DSA-3011-1","title":"mediawiki - security update","status":"published","published":"2014-08-23T00:00:00Z","modified":"2026-03-09T01:18:09.247683Z","updated_at":"2026-11-02T15:46:15.843838Z"},{"id":"MGASA-2014-0309","title":"Updated mediawiki packages fix security vulnerabilities","description":"MediaWiki before 1.23.2 is vulnerable to JSONP injection in Flash\n(CVE-2014-5241), XSS in mediawiki.page.image.pagination.js (CVE-2014-5242),\nand clickjacking between OutputPage and ParserOutput (CVE-2014-5243).\n\nThis update provides MediaWiki 1.23.2, fixing these and other issues.\n","status":"published","published":"2014-08-05T20:08:48Z","modified":"2026-04-16T06:24:53.253706881Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}