CVE-2014-5243: MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 does not enforce an...

Security readout for executives and security teams

This issue affects older MediaWiki releases that failed to apply iframe protection to transcluded pages. An attacker could host a crafted website that frames wiki content and tricks a logged-in user into clicking something they did not intend. Business risk depends on whether affected MediaWiki versions remain in use and what actions users can perform. Exposure is likely limited to organizations still running the listed old MediaWiki versions or vulnerable distribution packages. Publicly reachable wikis and admin-used internal wikis have higher practical concern because exploitation is browser-mediated and depends on user interaction. Address during normal vulnerability remediation unless an exposed affected wiki supports sensitive or privileged actions. The issue is old and not KEV-listed in the bundle, but legacy MediaWiki systems should be upgraded because clickjacking can turn trusted user sessions into business-impacting actions. Mitigation focus: Upgrade MediaWiki to 1.19.18, 1.22.9, 1.23.2, or a later fixed release.; For packaged deployments, apply the relevant Debian, Mandriva, or Mageia security update.; Check current MediaWiki vendor guidance before relying on interim configuration mitigations..

Prepared

Jun 14, 2026, 07:14 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.