CVEvulnerability
CVE-2014-1610
6.0 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2014-01-30
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.0 MEDIUM — AV:N/AC:M/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-20
Description
MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.
Affected configurations
• mediawiki mediawiki 1.19.0
• mediawiki mediawiki 1.19.1
• mediawiki mediawiki 1.19.2
• mediawiki mediawiki 1.19.3
• mediawiki mediawiki 1.19.4
• mediawiki mediawiki 1.19.5
• mediawiki mediawiki 1.19.6
• mediawiki mediawiki 1.19.7
• mediawiki mediawiki 1.19.8
• mediawiki mediawiki 1.19.9
• mediawiki mediawiki 1.19.10
• mediawiki mediawiki 1.21.1
• mediawiki mediawiki 1.21.2
• mediawiki mediawiki 1.21.3
• mediawiki mediawiki 1.21.4
• mediawiki mediawiki 1.22.0
• mediawiki mediawiki 1.22.1
Related
Weakness · CWE (1)
- CWE-20 Improper Input Validation weakness
References
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html lists.fedoraproject.org
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.html Vendor Advisory
- http://osvdb.org/102630 osvdb.org
- http://secunia.com/advisories/56695 Vendor Advisory
- http://secunia.com/advisories/57472 secunia.com
- http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html www.checkpoint.com
- http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html www.checkpoint.com
- http://www.debian.org/security/2014/dsa-2891 www.debian.org
- http://www.exploit-db.com/exploits/31329/ www.exploit-db.com
- http://www.osvdb.org/102631 www.osvdb.org
- http://www.securityfocus.com/bid/65223 www.securityfocus.com
- http://www.securitytracker.com/id/1029707 www.securitytracker.com
- https://bugzilla.wikimedia.org/attachment.cgi?id=14361&action=diff bugzilla.wikimedia.org
- https://bugzilla.wikimedia.org/attachment.cgi?id=14384&action=diff bugzilla.wikimedia.org
- https://bugzilla.wikimedia.org/show_bug.cgi?id=60339 bugzilla.wikimedia.org
- https://gerrit.wikimedia.org/r/#/c/110069/ Vendor Advisory
- https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php gerrit.wikimedia.org
- https://gerrit.wikimedia.org/r/#/c/110215/ gerrit.wikimedia.org
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.html lists.fedoraproject.org
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html lists.fedoraproject.org
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.html Vendor Advisory
- http://osvdb.org/102630 osvdb.org
- http://secunia.com/advisories/56695 Vendor Advisory
- http://secunia.com/advisories/57472 secunia.com
- http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html www.checkpoint.com
- http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html www.checkpoint.com
- http://www.debian.org/security/2014/dsa-2891 www.debian.org
- http://www.exploit-db.com/exploits/31329/ www.exploit-db.com
- http://www.osvdb.org/102631 www.osvdb.org
- http://www.securityfocus.com/bid/65223 www.securityfocus.com
- http://www.securitytracker.com/id/1029707 www.securitytracker.com
- https://bugzilla.wikimedia.org/attachment.cgi?id=14361&action=diff bugzilla.wikimedia.org
- https://bugzilla.wikimedia.org/attachment.cgi?id=14384&action=diff bugzilla.wikimedia.org
- https://bugzilla.wikimedia.org/show_bug.cgi?id=60339 bugzilla.wikimedia.org
- https://gerrit.wikimedia.org/r/#/c/110069/ Vendor Advisory
- https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php gerrit.wikimedia.org
- https://gerrit.wikimedia.org/r/#/c/110215/ gerrit.wikimedia.org