CVE-2017-8814

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attackers to replace text inside tags via a rule definition followed by "a lot of junk."

Metrics

CVSS 3.0 7.5/10CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-20

Affected software

Vendor	Product	Versions
n/a	MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2	MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2

References

http://www.securitytracker.com/id/1039812Third Party Advisory, VDB Entry
https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.htmlMailing List, Patch, Vendor Advisory
https://www.debian.org/security/2017/dsa-4036Third Party Advisory
http://www.securitytracker.com/id/1039812Third Party Advisory, VDB Entry
https://lists.wikimedia.org/pipermail/mediawiki-announce/2017-November/000216.htmlMailing List, Patch, Vendor Advisory
https://www.debian.org/security/2017/dsa-4036Third Party Advisory

Timeline

Published: Nov 15, 2017
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2017

CVE-2017-88157.5The language converter in MediaWiki before 1.27.4, 1.28.x before 1.28.3, and 1.29.x before 1.29.2 allows attribute injection attacks via glo CVE-2017-88169.8The NTLM authentication feature in curl and libcurl before 7.57.0 on 32-bit platforms allows attackers to cause a denial of service (integer CVE-2017-88179.8The FTP wildcard function in curl and libcurl before 7.57.0 allows remote attackers to cause a denial of service (out-of-bounds read and app CVE-2017-88189.8curl and libcurl before 7.57.0 on 32-bit platforms allow attackers to cause a denial of service (out-of-bounds access and application crash)CVE-2017-88197.5In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, the rep CVE-2017-88207.5In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, remote CVE-2017-88217.5In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, an atta CVE-2017-88223.7In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, relays CVE-2017-88238.1In Tor before 0.2.5.16, 0.2.6 through 0.2.8 before 0.2.8.17, 0.2.9 before 0.2.9.14, 0.3.0 before 0.3.0.13, and 0.3.1 before 0.3.1.9, there i CVE-2017-88247.8The dccp_disconnect function in net/dccp/proto.c in the Linux kernel through 4.14.3 allows local users to gain privileges or cause a denial CVE-2017-88257.5A null dereference vulnerability has been found in the MIME handling component of LibEtPan before 1.8, as used in MailCore and MailCore 2. A CVE-2017-88267.8FastStone Image Viewer 6.2 has a "User Mode Write AV" issue, possibly related to the jpeg_mem_term function in jmemnobs.c in libjpeg. This i