CVE-2014-2853 in MediaWiki
Summary
by MITRE
Cross-site scripting (XSS) vulnerability in includes/actions/InfoAction.php in MediaWiki before 1.21.9 and 1.22.x before 1.22.6 allows remote attackers to inject arbitrary web script or HTML via the sort key in an info action.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 05/12/2026
The CVE-2014-2853 vulnerability represents a critical cross-site scripting flaw discovered in MediaWiki's InfoAction.php component, affecting versions prior to 1.21.9 and 1.22.x prior to 1.22.6. This vulnerability resides within the information action handling mechanism of the popular wiki platform, which is widely used by organizations, educational institutions, and government bodies for collaborative content management. The flaw specifically targets the sort key parameter processing within the info action functionality, creating an avenue for malicious actors to execute unauthorized code execution within victim browsers.
The technical implementation of this vulnerability stems from inadequate input validation and output sanitization within the MediaWiki codebase. When users access the info action with a specially crafted sort key parameter, the application fails to properly escape or filter the input before rendering it in the web response. This allows attackers to inject malicious JavaScript code or HTML content that executes in the context of other users' browsers who view the affected pages. The vulnerability operates under CWE-79 which categorizes cross-site scripting as a code injection flaw, specifically targeting the improper handling of untrusted data in web applications. The attack vector requires minimal privileges as it can be exploited through standard web browser interactions without requiring authentication or administrative access.
The operational impact of this vulnerability extends beyond simple data theft or defacement, as it provides attackers with the capability to perform session hijacking, redirect users to malicious sites, or execute arbitrary commands within the victim's browser context. In environments where MediaWiki serves as a central collaboration platform for sensitive information, this vulnerability could enable attackers to access confidential documents, manipulate content, or establish persistent footholds within organizational networks. The vulnerability's exploitation can lead to privilege escalation scenarios when users with administrative privileges access affected pages, potentially allowing attackers to gain complete control over wiki content and user accounts.
Mitigation strategies for CVE-2014-2853 focus primarily on implementing proper input validation and output encoding mechanisms. Organizations should immediately upgrade to MediaWiki versions 1.21.9 or 1.22.6 and later, which contain patches addressing the specific input handling flaw in InfoAction.php. Additionally, implementing Content Security Policy headers, employing proper HTML escaping for all user-provided content, and conducting regular security audits of web applications can significantly reduce the risk of exploitation. The vulnerability aligns with ATT&CK technique T1566 which describes the use of web applications as attack vectors, specifically targeting the execution of malicious code through compromised web interfaces. Network-based solutions such as web application firewalls should also be deployed to provide additional layers of protection against similar vulnerabilities in the broader attack surface.