CVE-2014-2242

includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid…

published March 2, 2014

CVSS
—
EPSS
2%
Percentile
84.1
In the wild
Unconfirmed
What it is

includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.02441 · 84.1th percentile
Published
2014-03-02T02:00Z
EPSS history
Timeline
  • 02 MAR 02:00Z
    includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid…
    cvelistv5