CVE-2014-1610

Severity: medium (CVSS 6.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 42.8% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-01-30 · updated 2026-06-17
Weakness: CWE-20

Description

MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.

Affected products

Wikimedia Foundation MediaWiki: 1.19.0, 1.19.1, 1.19.2, 1.19.3, 1.19.4, 1.19.5 (+11)

References

http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.html
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html
http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.html
http://osvdb.org/102630
http://secunia.com/advisories/56695
http://secunia.com/advisories/57472
http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html
http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html
http://www.debian.org/security/2014/dsa-2891
http://www.exploit-db.com/exploits/31329/
http://www.osvdb.org/102631
http://www.securityfocus.com/bid/65223

Get alerted when CVE-2014-1610 or the next vulnerability affects your stack