{"id":"MGASA-2014-0555","aliases":[],"status":"published","title":"Updated mediawiki packages fix security vulnerabilities","description":"Updated mediawiki packages fix security vulnerabilities:\n\nIn MediaWiki before 1.23.8, thumb.php outputs wikitext message as raw HTML,\nwhich could lead to cross-site scripting. Permission to edit MediaWiki\nnamespace is required to exploit this.\n\nIn MediaWiki before 1.23.8, a malicious site can bypass CORS restrictions in\n$wgCrossSiteAJAXdomains in API calls if it only included an allowed domain as\npart of its name.","facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"published":"2014-12-26T17:04:58Z","modified":"2026-04-16T04:28:15Z","fixes":[{"ecosystem":"Mageia:4","package":"mediawiki","fixed_in":["1.23.8-1.mga4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Mageia:4","package":"mediawiki","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.23.8-1.mga4"}]}]}],"references":[{"url":"https://advisories.mageia.org/MGASA-2014-0555.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14866","tags":["report"]},{"url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-December/000173.html","tags":["web"]}],"sources":{"osv":[{"id":"MGASA-2014-0555","title":"Updated mediawiki packages fix security vulnerabilities","description":"Updated mediawiki packages fix security vulnerabilities:\n\nIn MediaWiki before 1.23.8, thumb.php outputs wikitext message as raw HTML,\nwhich could lead to cross-site scripting. Permission to edit MediaWiki\nnamespace is required to exploit this.\n\nIn MediaWiki before 1.23.8, a malicious site can bypass CORS restrictions in\n$wgCrossSiteAJAXdomains in API calls if it only included an allowed domain as\npart of its name.\n","status":"published","published":"2014-12-26T17:04:58Z","modified":"2026-04-16T04:28:15.934418Z","updated_at":"2026-11-02T15:49:39.488462Z"}]}}