CVE-2014-1610
Summary
| CVE | CVE-2014-1610 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2014-01-30 23:55:02 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php. |
Risk And Classification
Primary CVSS: v2.0 6 from [email protected]
AV:N/AC:M/Au:S/C:P/I:P/A:P
EPSS: 0.480410000 probability, percentile 0.977400000 (date 2026-05-04)
Problem Types: CWE-20 | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
SingleConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:S/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Mediawiki | Mediawiki | 1.19.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.19.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.19.10 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.19.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.19.3 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.19.4 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.19.5 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.19.6 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.19.7 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.19.8 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.19.9 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.21.1 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.21.2 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.21.3 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.21.4 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.22.0 | All | All | All |
| Application | Mediawiki | Mediawiki | 1.22.1 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| 404 Not Found | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.wikimedia.org | |
| [SECURITY] Fedora 19 Update: mediawiki-1.21.5-1.fc19 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 20 Update: mediawiki-1.21.5-1.fc20 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Debian -- Security Information -- DSA-2891-1 mediawiki, mediawiki-extensions | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Gerrit Code Review | af854a3a-2127-422b-91ae-364da2661108 | gerrit.wikimedia.org | |
| MediaWiki 1.22.1 PdfHandler - Remote Code Execution Exploit | af854a3a-2127-422b-91ae-364da2661108 | www.exploit-db.com | |
| MediaWiki Input Validation Flaws Let Remote Authenticated Users Execute Arbitrary Shell Commands - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| THREATCLOUD INTELLIGENCE | af854a3a-2127-422b-91ae-364da2661108 | www.checkpoint.com | |
| 404 Not Found | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.wikimedia.org | |
| Security Advisory SA56695 - MediaWiki Two Code Execution Vulnerabilities - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| Gerrit Code Review | af854a3a-2127-422b-91ae-364da2661108 | gerrit.wikimedia.org | |
| Gerrit Code Review | af854a3a-2127-422b-91ae-364da2661108 | gerrit.wikimedia.org | Vendor Advisory |
| MediaWiki Multiple Remote Code Execution Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| osvdb.org/102630 | af854a3a-2127-422b-91ae-364da2661108 | osvdb.org | |
| Check Point - Security Appliances, Security Gateways, Security Management, Endpoint Security, and Software Blades | af854a3a-2127-422b-91ae-364da2661108 | www.checkpoint.com | |
| Security Advisory SA57472 - Debian update for mediawiki and mediawiki-extensions - Secunia | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| ⚓ T62339 Reported RCE in djvu thumbnailing | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.wikimedia.org | |
| [MediaWiki-announce] MediaWiki Security Releases: 1.22.2, 1.21.5 and 1.19.11 | af854a3a-2127-422b-91ae-364da2661108 | lists.wikimedia.org | Vendor Advisory |
| www.osvdb.org/102631 | af854a3a-2127-422b-91ae-364da2661108 | www.osvdb.org | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.