CVE-2014-9487 XML external entity in n/a

Critical 9.8 Published 17 Oct 2017 Updated 6 Aug 2024

Remote attackers can exploit an XML External Entity vulnerability in the getid3 library to read arbitrary files or cause denial of service.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: None listed

What is CVE-2014-9487?

CVE-2014-9487 is a critical vulnerability in Mediawiki Mediawiki, published on 17 Oct 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The getid3 library in MediaWiki before 1.24.1, 1.23.8, 1.22.15 and 1.19.23 allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity (XXE) attack. NOTE: Related to CVE-2014-2053.

Weakness: CWE-611

Which versions are affected by CVE-2014-9487?

It affects 1 product.

Products include Mediawiki Mediawiki.

How do I fix CVE-2014-9487?

No fix has been published for CVE-2014-9487 yet. Limit exposure of the affected software until one is available.

Is CVE-2014-9487 being exploited?

There is no known exploitation of CVE-2014-9487 in the wild and no public exploit code.

All Mediawiki Mediawiki vulnerabilities

Sources

Also known as GHSA-rwqh-hfr8-59c3.