CVE-2015-2934

Fixed in a distro release EPSS 2%

MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 does not properly handle when the Zend interpreter xml_parse function does not expand entities, which allows remote attackers to inject arbitrary web script or HTML via a crafted SVG file.

Published 2015-04-13 · CVE record · OSV

Products: mediawiki

Distro releases