NVD

Id
36013  
Name
CVE-2014-9277  
Description
The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request, which causes the string length to change when converting the request to <NOT-cross-domain-policy>.  
Reject
 
CVSS Version
2  
CVSS Score
7.5  
Severity
High  
CVSS Base Score
7.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:P/I:P/A:P)  
Pub Date
2017-01-19  
Published
2015-01-04  
Modified Date
2015-01-06  
Seq
2014-9277  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
184163 36013 CVE-2014-9277 1031301  View
184164 36013 CVE-2014-9277 DSA-3100  View
184165 36013 CVE-2014-9277 [oss-security] 20141203 MediaWiki security release - 1.23.7  View
184166 36013 CVE-2014-9277 [oss-security] 20141204 Re: MediaWiki security release - 1.23.7  View
184167 36013 CVE-2014-9277 [MediaWiki-announce] 20141127 MediaWiki Security and Maintenance Releases: 1.23.7, 1.22.14 and 1.19.22  View
184168 36013 CVE-2014-9277 https://phabricator.wikimedia.org/T73478  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
18637 JVNDB-2014-007512 MediaWiki の OutputHandler.php の wfMangleFlashPolicy 関数における PHP オブジェクトインジェクション攻撃を実行される脆弱性 MediaWiki の OutputHandler.php の wfMangleFlashPolicy 関数には、PHP オブジェクトインジェクション攻撃を実行される脆弱性が存在します。 CVE-2014-9277 76570 CVE-2014-9277 36013 7.5 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-007512.html 2014-11-27 2015-01-09 View