CVE-2014-1610 MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metach...
MediumCVSS 6.0
EPSS 42.8%
Framework module
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/mediawiki(Debian:12) | < 1:1.19.11+dfsg-1 | 1:1.19.11+dfsg-1 |
| debian/mediawiki(Debian:13) | < 1:1.19.11+dfsg-1 | 1:1.19.11+dfsg-1 |
| debian/mediawiki(Debian:14) | < 1:1.19.11+dfsg-1 | 1:1.19.11+dfsg-1 |
| mediawiki | = 1.19.0 | No fix listed |
| mediawiki | = 1.19.1 | No fix listed |
| mediawiki | = 1.19.2 | No fix listed |
| mediawiki | = 1.19.3 | No fix listed |
| mediawiki | = 1.19.4 | No fix listed |
| mediawiki | = 1.19.5 | No fix listed |
| mediawiki | = 1.19.6 | No fix listed |
| mediawiki | = 1.19.7 | No fix listed |
| mediawiki | = 1.19.8 | No fix listed |
| mediawiki | = 1.19.9 | No fix listed |
| mediawiki | = 1.19.10 | No fix listed |
| mediawiki | = 1.21.1 | No fix listed |
| mediawiki | = 1.21.2 | No fix listed |
| mediawiki | = 1.21.3 | No fix listed |
| mediawiki | = 1.21.4 | No fix listed |
| mediawiki | = 1.22.0 | No fix listed |
| mediawiki | = 1.22.1 | No fix listed |
References
- Debian Security Tracker CVE-2014-1610 vendor-advisory
- FEDORA-2014-1802 vendor-advisory
- FEDORA-2014-1745 vendor-advisory
- [MediaWiki-announce] 20140128 MediaWiki Security Releases: 1.22.2, 1.21.5 and 1.19.11 mailing-list vendor-advisory
- 102630 vdb-entry
- 56695 third-party-advisory vendor-advisory
- 57472 third-party-advisory
- www.checkpoint.com
- www.checkpoint.com
- DSA-2891 vendor-advisory
- 31329 exploit
- 102631 vdb-entry
- 65223 vdb-entry
- 1029707 vdb-entry
- bugzilla.wikimedia.org
- bugzilla.wikimedia.org
- bugzilla.wikimedia.org
- gerrit.wikimedia.org vendor-advisory