Wikimedia · Mediawiki · CVE-2014-3966
**Name of the Vulnerable Software and Affected Versions**
MediaWiki versions 1.19.x through 1.19.15
MediaWiki versions 1.21.x through 1.21.9
MediaWiki versions 1.22.x through 1.22.6
**Description**
A cross-site scripting (XSS) issue exists in the Special:PasswordReset feature of MediaWiki. This occurs when the wgRawHtml option is enabled, allowing remote attackers to inject arbitrary web script or HTML via an invalid `username`.
**Recommendations**
For MediaWiki versions 1.19.x through 1.19.15, update to version 1.19.16 or later.
For MediaWiki versions 1.21.x through 1.21.9, update to version 1.21.10 or later.
For MediaWiki versions 1.22.x through 1.22.6, update to version 1.22.7 or later.