CVE-2014-9507
Severity CVSS v4.0:
Pending analysis
Type:
CWE-79
Cross-Site Scripting (XSS)
Publication date:
04/01/2015
Last modified:
12/04/2025
Description
MediaWiki 1.21.x, 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgContentHandlerUseDB is enabled, allows remote attackers to conduct cross-site scripting (XSS) attacks by setting the content model for a revision to JS.
Impact
Base Score 2.0
2.60
Severity 2.0
LOW
Vulnerable products and versions
| CPE | From | Up to |
|---|---|---|
| cpe:2.3:a:mediawiki:mediawiki:*:*:*:*:*:*:*:* | 1.19.21 (including) | |
| cpe:2.3:a:mediawiki:mediawiki:1.20:*:*:*:*:*:*:* | ||
| cpe:2.3:a:mediawiki:mediawiki:1.20.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:mediawiki:mediawiki:1.20.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:mediawiki:mediawiki:1.20.3:*:*:*:*:*:*:* | ||
| cpe:2.3:a:mediawiki:mediawiki:1.20.4:*:*:*:*:*:*:* | ||
| cpe:2.3:a:mediawiki:mediawiki:1.20.5:*:*:*:*:*:*:* | ||
| cpe:2.3:a:mediawiki:mediawiki:1.20.6:*:*:*:*:*:*:* | ||
| cpe:2.3:a:mediawiki:mediawiki:1.20.7:*:*:*:*:*:*:* | ||
| cpe:2.3:a:mediawiki:mediawiki:1.20.8:*:*:*:*:*:*:* | ||
| cpe:2.3:a:mediawiki:mediawiki:1.21:*:*:*:*:*:*:* | ||
| cpe:2.3:a:mediawiki:mediawiki:1.21.1:*:*:*:*:*:*:* | ||
| cpe:2.3:a:mediawiki:mediawiki:1.21.2:*:*:*:*:*:*:* | ||
| cpe:2.3:a:mediawiki:mediawiki:1.21.3:*:*:*:*:*:*:* | ||
| cpe:2.3:a:mediawiki:mediawiki:1.21.4:*:*:*:*:*:*:* |
To consult the complete list of CPE names with products and versions, see this page