CVE-2014-3966 in MediaWiki
Summary
by MITRE
Cross-site scripting (XSS) vulnerability in Special:PasswordReset in MediaWiki before 1.19.16, 1.21.x before 1.21.10, and 1.22.x before 1.22.7, when wgRawHtml is enabled, allows remote attackers to inject arbitrary web script or HTML via an invalid username.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 04/23/2025
The CVE-2014-3966 vulnerability represents a critical cross-site scripting flaw discovered in MediaWiki's Special:PasswordReset functionality across multiple version ranges including 1.19.16, 1.21.10, and 1.22.7. This vulnerability specifically targets the password reset feature that is fundamental to user account management within MediaWiki platforms. The flaw occurs when the wgRawHtml configuration parameter is enabled, creating a dangerous condition where user input is not properly sanitized before being rendered in web pages. The vulnerability stems from inadequate input validation and output encoding mechanisms that fail to properly handle malicious payloads within the username field during password reset operations.
The technical exploitation of this vulnerability relies on the improper handling of user-supplied data within the password reset interface. When wgRawHtml is enabled, MediaWiki processes HTML content directly without sufficient sanitization, allowing attackers to inject malicious scripts that execute in the context of other users' browsers. The attack vector specifically targets the username parameter within the Special:PasswordReset page, where an attacker can craft a malicious username containing script tags or other HTML elements that get executed when the page renders. This represents a classic reflected XSS vulnerability where the malicious input is immediately reflected back to the user without proper encoding or validation, making it particularly dangerous for widespread exploitation.
The operational impact of CVE-2014-3966 extends beyond simple script injection, potentially enabling attackers to perform session hijacking, steal user credentials, or redirect victims to malicious websites. The vulnerability affects organizations running MediaWiki installations where raw HTML processing is enabled, which is common in wikis requiring rich content formatting. Attackers can leverage this vulnerability to impersonate legitimate users, access restricted content, or perform unauthorized actions within the wiki environment. The vulnerability's persistence across multiple MediaWiki version lines indicates a systemic flaw in the input validation implementation that required patching across several release branches, highlighting the widespread nature of the issue.
Organizations should immediately implement mitigations including disabling wgRawHtml configuration when possible, applying the relevant security patches for MediaWiki versions 1.19.16, 1.21.10, and 1.22.7, and implementing proper input validation for all user-supplied data. The vulnerability aligns with CWE-79 which specifically addresses cross-site scripting flaws, and follows ATT&CK technique T1566.001 for initial access through malicious web content. Network-based mitigations such as web application firewalls can help detect and block malicious payloads, while user education regarding suspicious links and content can provide additional defense layers. Regular security audits of MediaWiki configurations should verify that wgRawHtml is only enabled when absolutely necessary and that proper sanitization mechanisms are in place for all user input processing.