CVE-2014-9507
MediaWiki 1.21.x 1.22.x < 1.22.14 1.23.x < 1.23.7 - Cross-Site Scripting via Content Model Revision
Title source: llmDescription
MediaWiki 1.21.x, 1.22.x before 1.22.14, and 1.23.x before 1.23.7, when $wgContentHandlerUseDB is enabled, allows remote attackers to conduct cross-site scripting (XSS) attacks by setting the content model for a revision to JS.
References (2)
Core 2
Core References
Vendor Advisory x_refsource_confirm
https://phabricator.wikimedia.org/T72901
Patch, Vendor Advisory mailing-list
x_refsource_mlist
https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-November/000170.html
Scores
EPSS
0.0022
EPSS Percentile
44.7%
Details
CWE
CWE-79
Status
published
Products (42)
mediawiki/mediawiki
1.20
mediawiki/mediawiki
1.20.1
mediawiki/mediawiki
1.20.2
mediawiki/mediawiki
1.20.3
mediawiki/mediawiki
1.20.4
mediawiki/mediawiki
1.20.5
mediawiki/mediawiki
1.20.6
mediawiki/mediawiki
1.20.7
mediawiki/mediawiki
1.20.8
mediawiki/mediawiki
1.21
... and 32 more
Published
Jan 04, 2015
Tracked Since
Feb 18, 2026