CVE-2014-2853: MediaWiki Core Cross-Site Scripting Vulnerability in InfoAction.php

mediawiki/core Updated 02 Oct 2025

Summary

17/05/2022

Disclosed on

CVE-2014-2853

CVE

Yes i

Fix available

Moderate

Severity

Not published

CVSS Score

CVE-2014-2853: Cross-site scripting vulnerability in includes/actions/InfoAction.php. Affects mediawiki/core across 2 version ranges.

< 1.21.9 >= 1.22.0, < 1.22.6

Fixed in 1.21.9 or 1.22.6, depending on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

MediaWiki is a free and open-source wiki software platform used to power Wikipedia and other wikis. It allows users to create and edit content collaboratively. The software is designed to handle a large number of users and content, providing features such as version control, user management, and extensibility through plugins. However, certain versions of MediaWiki are vulnerable to a cross-site scripting (XSS) attack, specifically in the InfoAction.php file, which can allow attackers to inject malicious scripts into web pages viewed by other users.

Vulnerability Detail

The vulnerability arises from improper handling of user input in the sort key parameter within the InfoAction.php file. This flaw allows remote attackers to inject arbitrary web scripts or HTML into the application. If exploited, this could lead to unauthorized actions being performed on behalf of users, data theft, or the spread of malware. The vulnerability affects MediaWiki versions prior to 1.21.9 and 1.22.x before 1.22.6, making it crucial for users of these versions to take immediate action.

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

< 1.21.9 1.21.9
```
composer require mediawiki/core:1.21.9
```
>= 1.22.0, < 1.22.6 1.22.6
```
composer require mediawiki/core:1.22.6
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

If immediate upgrading is not feasible, a temporary workaround is to restrict access to the affected functionality or sanitize user inputs to prevent script injection. However, this is not a permanent solution and should only be considered until the software can be updated.

Conclusion

The CVE-2014-2853 vulnerability in MediaWiki poses a significant risk to users of affected versions. It is essential to update to the latest patched versions to mitigate this risk. Users should also consider using tools like Vulert to monitor for vulnerabilities in their applications.

See every vulnerability recorded for mediawiki/core →