CVE-2014-1610 Command injection in n/a

What is CVE-2014-1610?

CVE-2014-1610 is a medium-severity command injection vulnerability in Mediawiki Mediawiki, published on 30 Jan 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.

Weakness: CWE-20

Which versions are affected by CVE-2014-1610?

It affects 1 product.

Products include Mediawiki Mediawiki.

How do I fix CVE-2014-1610?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2014-1610 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-1610 exists.

Public exploit code: 1 Metasploit module and 2 Exploit-DB entries.

Other vulnerabilities in Mediawiki Mediawiki

• CVE-2023-37303 Denial of service in n/a Critical 9.8
• CVE-2022-29904 SQL injection in n/a Critical 9.8
• CVE-2022-29906 Missing authorization in n/a Critical 9.8
• CVE-2022-28205 Business logic in n/a Critical 9.8
• CVE-2022-28206 Missing authorization in n/a Critical 9.8

All Mediawiki Mediawiki vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2014-1610, GHSA-88m3-jgcp-453j.