CVE-2014-9277 — Command Injection in Mediawiki

CWE-77 — Command Injection5 documents5 sources
Severity
7.5HIGHNVD
EPSS
0.9%
top 24.91%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MediawikiDebian Mediawiki
Timeline
PublishedJan 4
Latest updateMay 17

Description

The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing in a PHP format request, which causes the string length to change when converting the request to .

CVSS vector

AV:N/AC:L/C:P/I:P/A:PExploitability: 10.0 | Impact: 6.4

Affected Packages3 packages

▶debiandebian/mediawiki< mediawiki 1:1.19.20+dfsg-2.1 (bookworm)
▶Debianmediawiki/mediawiki< 1:1.19.20+dfsg-2.1+3
▶NVDmediawiki/mediawiki1.19.21+41

Patches

Patch: lists.wikimedia.org ↗Patch: lists.wikimedia.org ↗

🔴Vulnerability Details

2
GHSA
GHSA-p3m7-7j6c-hwc3: The wfMangleFlashPolicy function in OutputHandler↗2022-05-17
▶
OSV
CVE-2014-9277: The wfMangleFlashPolicy function in OutputHandler↗2015-01-04
▶

📋Vendor Advisories

1
Debian
CVE-2014-9277: mediawiki - The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.2...↗2014
▶

💬Community

1
Bugzilla
CVE-2014-9507 CVE-2014-9277 mediawiki: security issues fixed in the 1.23.7, 1.22.14, and 1.19.22 releases↗2014-12-03
▶
CVE-2014-9277 — Command Injection in Debian Mediawiki | cvebase