SecuritySpace - CVE-2014-2242

Vulnerability Search		Search 324607 CVE descriptions and 145615 test descriptions, access 10,000+ cross references.
	Tests CVE All

CVE ID: CVE-2014-2242

Description: includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.

Test IDs: None available

Cross References: Common Vulnerability Exposure (CVE) ID: CVE-2014-2242
BugTraq ID: 65910
http://www.securityfocus.com/bid/65910
http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html
http://openwall.com/lists/oss-security/2014/02/28/1
http://openwall.com/lists/oss-security/2014/03/01/2

CVE ID:	CVE-2014-2242
Description:	includes/upload/UploadBase.php in MediaWiki before 1.19.12, 1.20.x and 1.21.x before 1.21.6, and 1.22.x before 1.22.3 does not prevent use of invalid namespaces in SVG files, which allows remote attackers to conduct cross-site scripting (XSS) attacks via an SVG upload, as demonstrated by use of a W3C XHTML namespace in conjunction with an IFRAME element.
Test IDs:	None available
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2014-2242 BugTraq ID: 65910 http://www.securityfocus.com/bid/65910 http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-February/000141.html http://openwall.com/lists/oss-security/2014/02/28/1 http://openwall.com/lists/oss-security/2014/03/01/2