{"id":"GHSA-6h86-9r5g-f2h5","summary":"Cross-site scripting vulnerability in includes/actions/InfoAction.php","details":"Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.","aliases":["CVE-2014-2853"],"modified":"2024-12-02T05:45:20.512467Z","published":"2022-05-17T04:07:54Z","database_specific":{"nvd_published_at":"2014-04-29T18:55:00Z","cwe_ids":["CWE-79"],"severity":"MODERATE","github_reviewed":true,"github_reviewed_at":"2024-11-01T23:10:24Z"},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2014-2853"},{"type":"WEB","url":"https://github.com/wikimedia/mediawiki-core/commit/0b695ae09aada343ab59be4a3c9963995a1143b6"},{"type":"WEB","url":"https://bugzilla.redhat.com/show_bug.cgi?id=1091967"},{"type":"WEB","url":"https://bugzilla.wikimedia.org/show_bug.cgi?id=63251"},{"type":"PACKAGE","url":"https://github.com/wikimedia/mediawiki"},{"type":"WEB","url":"https://www.mediawiki.org/wiki/Release_notes/1.21#Changes_since_1.21.8"},{"type":"WEB","url":"https://www.mediawiki.org/wiki/Release_notes/1.22#Changes_since_1.22.5"},{"type":"WEB","url":"http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-April/000149.html"},{"type":"WEB","url":"http://secunia.com/advisories/58262"},{"type":"WEB","url":"http://www.securityfocus.com/bid/67068"},{"type":"WEB","url":"http://www.securitytracker.com/id/1030161"}],"affected":[{"package":{"name":"mediawiki/core","ecosystem":"Packagist","purl":"pkg:composer/mediawiki/core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.21.9"}]}],"versions":["1.20.3","1.20.4","1.20.5","1.20.6","1.20.7","1.20.8","1.21.0","1.21.1","1.21.2","1.21.3","1.21.4","1.21.5","1.21.6","1.21.7","1.21.8"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6h86-9r5g-f2h5/GHSA-6h86-9r5g-f2h5.json"}},{"package":{"name":"mediawiki/core","ecosystem":"Packagist","purl":"pkg:composer/mediawiki/core"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"1.22.0"},{"fixed":"1.22.6"}]}],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-6h86-9r5g-f2h5/GHSA-6h86-9r5g-f2h5.json"}}],"schema_version":"1.9.0"}