CVE-2014-1610

N/A Unknown
Published: January 30, 2014 Modified: April 29, 2026
View on NVD

Description

MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.html
Source: cve@mitre.org
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html
Source: cve@mitre.org
http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.html
Source: cve@mitre.org
Vendor Advisory
http://osvdb.org/102630
Source: cve@mitre.org
http://secunia.com/advisories/56695
Source: cve@mitre.org
Vendor Advisory
http://secunia.com/advisories/57472
Source: cve@mitre.org
http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html
Source: cve@mitre.org
http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html
Source: cve@mitre.org
http://www.debian.org/security/2014/dsa-2891
Source: cve@mitre.org
http://www.exploit-db.com/exploits/31329/
Source: cve@mitre.org
http://www.osvdb.org/102631
Source: cve@mitre.org
http://www.securityfocus.com/bid/65223
Source: cve@mitre.org
http://www.securitytracker.com/id/1029707
Source: cve@mitre.org
https://bugzilla.wikimedia.org/attachment.cgi?id=14361&action=diff
Source: cve@mitre.org
https://bugzilla.wikimedia.org/attachment.cgi?id=14384&action=diff
Source: cve@mitre.org
https://bugzilla.wikimedia.org/show_bug.cgi?id=60339
Source: cve@mitre.org
https://gerrit.wikimedia.org/r/#/c/110069/
Source: cve@mitre.org
Vendor Advisory
https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php
Source: cve@mitre.org
https://gerrit.wikimedia.org/r/#/c/110215/
Source: cve@mitre.org
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.html
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
http://osvdb.org/102630
Source: af854a3a-2127-422b-91ae-364da2661108
http://secunia.com/advisories/56695
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
http://secunia.com/advisories/57472
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.debian.org/security/2014/dsa-2891
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.exploit-db.com/exploits/31329/
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.osvdb.org/102631
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securityfocus.com/bid/65223
Source: af854a3a-2127-422b-91ae-364da2661108
http://www.securitytracker.com/id/1029707
Source: af854a3a-2127-422b-91ae-364da2661108
https://bugzilla.wikimedia.org/attachment.cgi?id=14361&action=diff
Source: af854a3a-2127-422b-91ae-364da2661108
https://bugzilla.wikimedia.org/attachment.cgi?id=14384&action=diff
Source: af854a3a-2127-422b-91ae-364da2661108
https://bugzilla.wikimedia.org/show_bug.cgi?id=60339
Source: af854a3a-2127-422b-91ae-364da2661108
https://gerrit.wikimedia.org/r/#/c/110069/
Source: af854a3a-2127-422b-91ae-364da2661108
Vendor Advisory
https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php
Source: af854a3a-2127-422b-91ae-364da2661108
https://gerrit.wikimedia.org/r/#/c/110215/
Source: af854a3a-2127-422b-91ae-364da2661108

38 reference(s) from NVD

Quick Stats

CVSS v3 Score
N/A / 10.0
EPSS (Exploit Probability)
48.0%
98th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-20

Affected Vendors

mediawiki

Related CVEs

CVE-2026-7182 N/A
CVE-2026-41553 N/A
CVE-2026-41552 N/A
CVE-2026-8503 N/A
CVE-2026-8454 N/A