CVE-2014-1610
Estado: ModificadaMedia (6)—💥 Exploit
MediaWiki 1.22.x en versiones anteriores a 1.22.2, 1.21.x en versiones anteriores a 1.21.5 y 1.19.x en versiones anteriores a 1.19.11, cuando el soporte a la carga de archivos DjVu o PDF está habilitado, permite a atacantes remotos ejecutar comandos arbitrarios a través de metacaracteres shell en (1) el parámetro page en includes/media/DjVu.php; (2) el parámetro w (también conocido como campo width) en thumb.php, lo que no se maneja correctamente por includes/media/PdfHandler_body.php; y posiblemente vectores no especificados en (3) includes/media/Bitmap.php e (4) includes/media/ImageHandler.php.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:M/Au:S/C:P/I:P/A:P
- Puntuación base: 6
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 43%
- Percentil entre todas las CVEs puntuadas: 99
- Fecha de la puntuación: 8/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
💥 Exploits públicos
Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.
- Módulo de Metasploit (exploit fiable y al alcance de cualquiera) · MediaWiki Thumb.php Remote Command Execution
- Publicado en Exploit-DB · MediaWiki - 'Thumb.php' Remote Command Execution (Metasploit) (19/2/2014)
- Publicado en Exploit-DB · MediaWiki 1.22.1 PdfHandler - Remote Code Execution (1/2/2014)
Tecnologías afectadas (1)
CWE
- CWE-20
Referencias
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.html
- http://osvdb.org/102630
- http://secunia.com/advisories/56695
- http://secunia.com/advisories/57472
- http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html
- http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html
- http://www.debian.org/security/2014/dsa-2891
- http://www.exploit-db.com/exploits/31329/
- http://www.osvdb.org/102631
- http://www.securityfocus.com/bid/65223
- http://www.securitytracker.com/id/1029707
- https://bugzilla.wikimedia.org/attachment.cgi?id=14361&action=diff
- https://bugzilla.wikimedia.org/attachment.cgi?id=14384&action=diff
- https://bugzilla.wikimedia.org/show_bug.cgi?id=60339
- https://gerrit.wikimedia.org/r/#/c/110069/
- https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php
- https://gerrit.wikimedia.org/r/#/c/110215/
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.html
- http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html
- http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.html
- http://osvdb.org/102630
- http://secunia.com/advisories/56695
- http://secunia.com/advisories/57472
- http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html
- http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html
- http://www.debian.org/security/2014/dsa-2891
- http://www.exploit-db.com/exploits/31329/
- http://www.osvdb.org/102631
- http://www.securityfocus.com/bid/65223
- http://www.securitytracker.com/id/1029707
- https://bugzilla.wikimedia.org/attachment.cgi?id=14361&action=diff
- https://bugzilla.wikimedia.org/attachment.cgi?id=14384&action=diff
- https://bugzilla.wikimedia.org/show_bug.cgi?id=60339
- https://gerrit.wikimedia.org/r/#/c/110069/
- https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php
- https://gerrit.wikimedia.org/r/#/c/110215/
JSON original (NVD)
Mostrar
{
"id": "CVE-2014-1610",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 6,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:S/C:P/I:P/A:P",
"authentication": "SINGLE",
"integrityImpact": "PARTIAL",
"accessComplexity": "MEDIUM",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 6.8,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2014-01-30T23:55:02.413",
"references": [
{
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.html",
"source": "cve@mitre.org"
},
{
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html",
"source": "cve@mitre.org"
},
{
"url": "http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.html",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://osvdb.org/102630",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/56695",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/57472",
"source": "cve@mitre.org"
},
{
"url": "http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html",
"source": "cve@mitre.org"
},
{
"url": "http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html",
"source": "cve@mitre.org"
},
{
"url": "http://www.debian.org/security/2014/dsa-2891",
"source": "cve@mitre.org"
},
{
"url": "http://www.exploit-db.com/exploits/31329/",
"source": "cve@mitre.org"
},
{
"url": "http://www.osvdb.org/102631",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/65223",
"source": "cve@mitre.org"
},
{
"url": "http://www.securitytracker.com/id/1029707",
"source": "cve@mitre.org"
},
{
"url": "https://bugzilla.wikimedia.org/attachment.cgi?id=14361&action=diff",
"source": "cve@mitre.org"
},
{
"url": "https://bugzilla.wikimedia.org/attachment.cgi?id=14384&action=diff",
"source": "cve@mitre.org"
},
{
"url": "https://bugzilla.wikimedia.org/show_bug.cgi?id=60339",
"source": "cve@mitre.org"
},
{
"url": "https://gerrit.wikimedia.org/r/#/c/110069/",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php",
"source": "cve@mitre.org"
},
{
"url": "https://gerrit.wikimedia.org/r/#/c/110215/",
"source": "cve@mitre.org"
},
{
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127942.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.fedoraproject.org/pipermail/package-announce/2014-February/127948.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://lists.wikimedia.org/pipermail/mediawiki-announce/2014-January/000140.html",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://osvdb.org/102630",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/56695",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/57472",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.checkpoint.com/defense/advisories/public/2014/cpai-26-jan.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.checkpoint.com/threatcloud-central/articles/2014-01-28-tc-researchers-discover.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.debian.org/security/2014/dsa-2891",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.exploit-db.com/exploits/31329/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.osvdb.org/102631",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/65223",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id/1029707",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.wikimedia.org/attachment.cgi?id=14361&action=diff",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.wikimedia.org/attachment.cgi?id=14384&action=diff",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://bugzilla.wikimedia.org/show_bug.cgi?id=60339",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://gerrit.wikimedia.org/r/#/c/110069/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://gerrit.wikimedia.org/r/#/c/110069/2/includes/media/Bitmap.php",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://gerrit.wikimedia.org/r/#/c/110215/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "MediaWiki 1.22.x before 1.22.2, 1.21.x before 1.21.5, and 1.19.x before 1.19.11, when DjVu or PDF file upload support is enabled, allows remote attackers to execute arbitrary commands via shell metacharacters in (1) the page parameter to includes/media/DjVu.php; (2) the w parameter (aka width field) to thumb.php, which is not properly handled by includes/media/PdfHandler_body.php; and possibly unspecified vectors in (3) includes/media/Bitmap.php and (4) includes/media/ImageHandler.php."
},
{
"lang": "es",
"value": "MediaWiki 1.22.x en versiones anteriores a 1.22.2, 1.21.x en versiones anteriores a 1.21.5 y 1.19.x en versiones anteriores a 1.19.11, cuando el soporte a la carga de archivos DjVu o PDF está habilitado, permite a atacantes remotos ejecutar comandos arbitrarios a través de metacaracteres shell en (1) el parámetro page en includes/media/DjVu.php; (2) el parámetro w (también conocido como campo width) en thumb.php, lo que no se maneja correctamente por includes/media/PdfHandler_body.php; y posiblemente vectores no especificados en (3) includes/media/Bitmap.php e (4) includes/media/ImageHandler.php."
}
],
"lastModified": "2026-06-17T00:05:16.833",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A7C29D44-2964-483F-B672-27B5CE471DA6"
},
{
"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "172FEFE5-9900-49D0-9E14-2FA4A7912D23"
},
{
"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "CA3205F5-3A29-4D45-AC95-83174F8969BB"
},
{
"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5547DA02-3BEC-4278-A714-25CCB820AA79"
},
{
"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A3E5609D-EC04-4088-9B61-ABDD256200F7"
},
{
"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B23B09BB-8F43-4D60-A37F-D8685584AF4B"
},
{
"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.6:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9A8A3F38-9A86-4346-9337-5C2A1DED37C0"
},
{
"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.7:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "49CCC3B5-9BD4-40B4-AF1A-DF4B2A6DC12D"
},
{
"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.8:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "36DA1112-69AB-408A-886E-F248516FDE11"
},
{
"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.9:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DA85F3B7-9CB4-481C-B1A5-AB95F81C4126"
},
{
"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.19.10:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A25C57E2-8E04-4A54-9211-C7B4B7CC4E89"
},
{
"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.21.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3DA12531-818E-4AD7-A3E7-467604775416"
},
{
"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.21.2:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "1E87AB00-90DD-4548-B23A-42673DDFD1D1"
},
{
"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.21.3:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "01D8F235-2F1B-4198-A91E-B2723293AA36"
},
{
"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.21.4:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D2A5F4A7-40E7-42D0-8482-647D0EC54AC7"
},
{
"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.22.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DB117E2F-D4CD-4CED-BCEF-3C821A431F6A"
},
{
"criteria": "cpe:2.3:a:mediawiki:mediawiki:1.22.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "B461B44C-37D2-480B-9645-B7E8720416C3"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}