CVE-2014-9478

MediaWiki - Cross-Site Scripting via ExpandTemplates Extension Preview

Title source: llm
STIX 2.1

Description

Cross-site scripting (XSS) vulnerability in the preview in the ExpandTemplates extension for MediaWiki, when $wgRawHTML is set to true, allows remote attackers to inject arbitrary web script or HTML via the wpInput parameter to the Special:ExpandTemplates page.

References (4)

Core 4
Core References
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2015/01/03/13
Exploit x_refsource_confirm
https://phabricator.wikimedia.org/T73111
Mailing List mailing-list x_refsource_mlist
http://www.openwall.com/lists/oss-security/2014/12/21/2

Scores

EPSS 0.0026
EPSS Percentile 48.8%

Details

CWE
CWE-79
Status published
Products (46)
mediawiki/mediawiki 1.20
mediawiki/mediawiki 1.20.1
mediawiki/mediawiki 1.20.2
mediawiki/mediawiki 1.20.3
mediawiki/mediawiki 1.20.4
mediawiki/mediawiki 1.20.5
mediawiki/mediawiki 1.20.6
mediawiki/mediawiki 1.20.7
mediawiki/mediawiki 1.20.8
mediawiki/mediawiki 1.21
... and 36 more
Published Jan 16, 2015
Tracked Since Feb 18, 2026