GCVE - cpe:2.3:a:mediawiki:mediawiki:1.23.8:*:*:*:*:*:*:*

Approved changes feed: RSS · Atom

cpe:2.3:a:mediawiki:mediawiki:1.23.8:*:*:*:*:*:*:*

part: a version: 1.23.8 update: *

Vendor	Mediawiki (`cdb1ca1d-4622-5407-a7d8-3e891579b8c5`)
Product	Mediawiki (`ab97168e-95e7-5d6e-a2ac-f8d27117dc4d`)
Edition	*
Language	*
Software edition	*
Target software	*
Target hardware	*
Other	*
Notes	Imported from NVD CPE 2.0 feed

PURL mappings

PURL	Source	Last updated
`pkg:github/wikimedia/mediawiki`	purl2cpe	2026-06-01 10:10:57.618423
`pkg:wikimedia/mediawiki`	purl2cpe	2026-06-01 10:10:57.618424

Vulnerability references

Identifier	cpeApplicability	Submitted	db.gcve.eu details	Rationale
`CVE:CVE-2015-2942`	vulnerable	2026-06-08 05:06:36.273486	Details available MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to cause a denial of service (CPU and memory consumption) via a large number of nested entity references in an (1) SVG file or (2) XMP metadata in a PDF file, aka a "billion laughs attack," a different vulnerability than CVE-2015-2937. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.575Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1 https://lists.wikimedia.org/pipermail/mediawiki-announce/2015-March/000175.html	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2941`	vulnerable	2026-06-08 05:06:36.272042	Details available Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM, allows remote attackers to inject arbitrary web script or HTML via an invalid parameter in a wddx format request to api.php, which is not properly handled in an error message, related to unsafe calls to wddx_serialize_value. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.872Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 https://phabricator.wikimedia.org/T85851 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2938`	vulnerable	2026-06-08 05:06:36.241019	Details available Cross-site scripting (XSS) vulnerability in MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to inject arbitrary web script or HTML via a custom JavaScript file, which is not properly handled when previewing the file. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.836Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2937`	vulnerable	2026-06-08 05:06:36.239587	Details available MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2, when using HHVM or Zend PHP, allows remote attackers to cause a denial of service ("quadratic blowup" and memory consumption) via an XML file containing an entity declaration with long replacement text and many references to this entity, a different vulnerability than CVE-2015-2942. Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.563Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2935`	vulnerable	2026-06-08 05:06:36.237746	Details available MediaWiki before 1.19.24, 1.2x before 1.23.9, and 1.24.x before 1.24.2 allows remote attackers to bypass the SVG filtering and obtain sensitive user information via a mixed case @import in a style element in an SVG file, as demonstrated by "@imporT." Published: 2015-04-13T14:00:00.000Z Updated: 2024-08-06T05:32:20.590Z Open on db.gcve.eu Reference links https://security.gentoo.org/glsa/201510-05 http://www.mandriva.com/security/advisories?name=MDVSA-2015:200 http://www.securityfocus.com/bid/73477 http://www.openwall.com/lists/oss-security/2015/04/07/3 http://www.openwall.com/lists/oss-security/2015/04/01/1	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2934`	vulnerable	2026-06-08 05:06:36.236341	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2933`	vulnerable	2026-06-08 05:06:36.234779	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2932`	vulnerable	2026-06-08 05:06:36.233158	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data
`CVE:CVE-2015-2931`	vulnerable	2026-06-08 05:06:36.230654	db.gcve.eu details were skipped to keep the page responsive. Open on db.gcve.eu	Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.