PT-2014-6361 · Wikimedia+1 · Mediawiki+1

Pleasestand · Published 2014-08-05 · Updated 2017-01-07 · CVE-2014-5243

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions MediaWiki versions 1.20.x through 1.22.x before 1.22.9 MediaWiki versions 1.23.x before 1.23.2 MediaWiki before 1.19.18

Description The issue makes it easier for remote attackers to conduct clickjacking attacks via a crafted web site, as it does not enforce an IFRAME protection mechanism for transcluded pages.

Recommendations For MediaWiki versions 1.20.x through 1.22.x before 1.22.9, update to version 1.22.9 or later. For MediaWiki versions 1.23.x before 1.23.2, update to version 1.23.2 or later. For MediaWiki before 1.19.18, update to version 1.19.18 or later.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2014-2021

CVE-2014-5243

DSA-3011-1

MGASA-2014-0309

Affected Products

Alt Linux

Mediawiki

References · 23

• 🔥 https://bugzilla.wikimedia.org/show_bug.cgi?id=65778 · Exploit
• https://security-tracker.debian.org/tracker/CVE-2014-5243 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5241 · Security Note
• http://debian.org/security/2014/dsa-3011 · Vendor Advisory
• http://mandriva.com/security/advisories?name=MDVSA-2014:153 · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2014-2021 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-5243 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5243 · Security Note
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-5243 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-5243 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0309 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-5242 · Security Note
• https://advisories.mageia.org/MGASA-2014-0309.html · Security Note
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-July/000157.html · Note
• https://packages.altlinux.org/ru/vuln/CVE-2014-5243 · Note