{"api_version":"1","generated_at":"2026-07-23T08:12:33+00:00","cve":"CVE-2014-5242","urls":{"html":"https://cve.report/CVE-2014-5242","api":"https://cve.report/api/cve/CVE-2014-5242.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2014-5242","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2014-5242"},"summary":{"title":"CVE-2014-5242","description":"Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value.","state":"PUBLISHED","assigner":"mitre","published_at":"2014-08-22 17:55:02","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:153","name":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:153","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"www.mandriva.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://openwall.com/lists/oss-security/2014/08/14/5","name":"http://openwall.com/lists/oss-security/2014/08/14/5","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"oss-security - Re: Possible CVE Request: MediaWiki Security and Maintenance Releases: 1.19.18, 1.22.9 and 1.23.2","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/69135","name":"http://www.securityfocus.com/bid/69135","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"MediaWiki 'mediawiki.page.image.pagination.js' Cross Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=66608","name":"https://bugzilla.wikimedia.org/show_bug.cgi?id=66608","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit","Vendor Advisory"],"title":"T68608 XSS in mediawiki.page.image.pagination.js","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-July/000157.html","name":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-July/000157.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"[MediaWiki-announce] MediaWiki Security and Maintenance Releases: 1.19.18, 1.22.9 and 1.23.2","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://advisories.mageia.org/MGASA-2014-0309.html","name":"http://advisories.mageia.org/MGASA-2014-0309.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Mageia Advisory: MGASA-2014-0309 - Updated mediawiki packages fix security vulnerabilities","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-5242","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-5242","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2014","cve_id":"5242","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.22.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"5242","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.22.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"5242","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.22.2","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"5242","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.22.3","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"5242","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.22.4","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"5242","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.22.5","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"5242","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.22.6","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"5242","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.22.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"5242","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.22.8","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"5242","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.23.0","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2014","cve_id":"5242","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"mediawiki","cpe5":"mediawiki","cpe6":"1.23.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T11:41:48.075Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"[MediaWiki-announce] 20140730 MediaWiki Security and Maintenance Releases: 1.19.18, 1.22.9 and 1.23.2","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-July/000157.html"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=66608"},{"name":"MDVSA-2014:153","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:153"},{"name":"69135","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/69135"},{"name":"[oss-security] 20140814 Re: Possible CVE Request: MediaWiki Security and Maintenance Releases: 1.19.18, 1.22.9 and 1.23.2","tags":["mailing-list","x_refsource_MLIST","x_transferred"],"url":"http://openwall.com/lists/oss-security/2014/08/14/5"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://advisories.mageia.org/MGASA-2014-0309.html"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2014-08-01T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2015-04-29T18:57:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"[MediaWiki-announce] 20140730 MediaWiki Security and Maintenance Releases: 1.19.18, 1.22.9 and 1.23.2","tags":["mailing-list","x_refsource_MLIST"],"url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-July/000157.html"},{"tags":["x_refsource_CONFIRM"],"url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=66608"},{"name":"MDVSA-2014:153","tags":["vendor-advisory","x_refsource_MANDRIVA"],"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:153"},{"name":"69135","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/69135"},{"name":"[oss-security] 20140814 Re: Possible CVE Request: MediaWiki Security and Maintenance Releases: 1.19.18, 1.22.9 and 1.23.2","tags":["mailing-list","x_refsource_MLIST"],"url":"http://openwall.com/lists/oss-security/2014/08/14/5"},{"tags":["x_refsource_CONFIRM"],"url":"http://advisories.mageia.org/MGASA-2014-0309.html"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2014-5242","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"[MediaWiki-announce] 20140730 MediaWiki Security and Maintenance Releases: 1.19.18, 1.22.9 and 1.23.2","refsource":"MLIST","url":"https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-July/000157.html"},{"name":"https://bugzilla.wikimedia.org/show_bug.cgi?id=66608","refsource":"CONFIRM","url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=66608"},{"name":"MDVSA-2014:153","refsource":"MANDRIVA","url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:153"},{"name":"69135","refsource":"BID","url":"http://www.securityfocus.com/bid/69135"},{"name":"[oss-security] 20140814 Re: Possible CVE Request: MediaWiki Security and Maintenance Releases: 1.19.18, 1.22.9 and 1.23.2","refsource":"MLIST","url":"http://openwall.com/lists/oss-security/2014/08/14/5"},{"name":"http://advisories.mageia.org/MGASA-2014-0309.html","refsource":"CONFIRM","url":"http://advisories.mageia.org/MGASA-2014-0309.html"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2014-5242","datePublished":"2014-08-22T17:00:00.000Z","dateReserved":"2014-08-14T00:00:00.000Z","dateUpdated":"2024-08-06T11:41:48.075Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2014-08-22 17:55:02","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.22.0:*:*:*:*:*:*:*","matchCriteriaId":"DB117E2F-D4CD-4CED-BCEF-3C821A431F6A"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.22.1:*:*:*:*:*:*:*","matchCriteriaId":"B461B44C-37D2-480B-9645-B7E8720416C3"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.22.2:*:*:*:*:*:*:*","matchCriteriaId":"E491E3AD-0FB2-41CD-B852-CAFCA397A45A"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.22.3:*:*:*:*:*:*:*","matchCriteriaId":"CBD50108-A301-4B5B-9047-6FD6792442B1"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.22.4:*:*:*:*:*:*:*","matchCriteriaId":"91BBFEC5-A933-4178-919D-9AC87CF76D21"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.22.5:*:*:*:*:*:*:*","matchCriteriaId":"BD3CA0EC-1AC1-48A1-8BB8-95DCCE1C283A"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.22.6:*:*:*:*:*:*:*","matchCriteriaId":"9343410C-E076-4362-8094-5BA5582E9675"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.22.7:*:*:*:*:*:*:*","matchCriteriaId":"F96BBB28-AB3C-4082-B035-8CCB761C2530"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.22.8:*:*:*:*:*:*:*","matchCriteriaId":"7389C3B9-B32D-46CC-8615-22CF7BDCD829"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.23.0:*:*:*:*:*:*:*","matchCriteriaId":"6044842D-0C23-4683-9BCC-9FE40AE8353F"},{"vulnerable":true,"criteria":"cpe:2.3:a:mediawiki:mediawiki:1.23.1:*:*:*:*:*:*:*","matchCriteriaId":"2BFCBB5A-F5F8-400E-916A-EB87F84853D9"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2014","CveId":"5242","Ordinal":"1","Title":"CVE-2014-5242","CVE":"CVE-2014-5242","Year":"2014"},"notes":[{"CveYear":"2014","CveId":"5242","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in mediawiki.page.image.pagination.js in MediaWiki 1.22.x before 1.22.9 and 1.23.x before 1.23.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving the multipageimagenavbox class in conjunction with an action=raw value.","Type":"Description","Title":"CVE-2014-5242"},{"CveYear":"2014","CveId":"5242","Ordinal":"2","NoteData":"2014-08-22","Type":"Other","Title":"Published"},{"CveYear":"2014","CveId":"5242","Ordinal":"3","NoteData":"2015-04-29","Type":"Other","Title":"Modified"}]}}}