CVE-2014-9277
The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through...
The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request, which causes the string length to change when converting the request to <NOT-cross-domain-policy>.
Exploit likelihood
What each source reports
NVD Score used
The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request, which causes the string length to change when converting the request to <NOT-cross-domain-policy>.
- Record
CVE-2014-9277- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-77
- Updated
- 2026-11-02
CVE List No score
The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request, which causes the string length to change when converting the request to <NOT-cross-domain-policy>.
- Record
CVE-2014-9277- Updated
- 2026-11-02
EUVDEUVD-2014-9102 No score
The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request, which causes the string length to change when converting the request to <NOT-cross-domain-policy>.
- Record
EUVD-2014-9102- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-p3m7-7j6c-hwc3 No score
The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through...
The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request, which causes the string length to change when converting the request to <NOT-cross-domain-policy>.
- Record
GHSA-p3m7-7j6c-hwc3- Weakness
- CWE-77
- Updated
- 2026-11-02
OSV No score
The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request, which causes the string length to change when converting the request to <NOT-cross-domain-policy>.
- Record
CVE-2014-9277- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-9277 No score
The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request, which causes the string length to change when converting the request to <NOT-cross-domain-policy>.
- Record
DEBIAN-CVE-2014-9277- Updated
- 2026-11-02
OSVMGASA-2014-0506 No score
Updated mediawiki packages fix security vulnerabilies
In MediaWiki before 1.23.7, a missing CSRF check could allow reflected XSS on wikis that allow raw HTML (CVE-2014-9276).
MediaWiki's <cross-domain-policy> mangling, in MediaWiki before 1.23.7, could allow an article editor to inject code into API consumers that blindly unserialize PHP representations of the page from the API (CVE-2014-9277).
This update provides MediaWiki 1.23.7, which fixes these security issues and other bugs.
- Record
MGASA-2014-0506- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
mediawikiDebian:12 |
before 1:1.19.20+dfsg-2.1 | 1:1.19.20+dfsg-2.1 |
mediawikiDebian:13 |
before 1:1.19.20+dfsg-2.1 | 1:1.19.20+dfsg-2.1 |
mediawikiDebian:14 |
before 1:1.19.20+dfsg-2.1 | 1:1.19.20+dfsg-2.1 |
mediawikiDebian:7 |
before 1:1.19.20+dfsg-0+deb7u2, plus listed versions 1:1.19.10+dfsg-11:1.19.11+dfsg-0+deb7u11:1.19.11+dfsg-11:1.19.12+dfsg-11:1.19.13+dfsg-1 Show 25 moreShow less1:1.19.14+dfsg-0+deb7u11:1.19.14+dfsg-0+deb7u21:1.19.14+dfsg-11:1.19.15+dfsg-0+deb7u11:1.19.15+dfsg-11:1.19.15+dfsg-21:1.19.16+dfsg-0+deb7u11:1.19.16+dfsg-11:1.19.17+dfsg-11:1.19.18+dfsg-0+deb7u11:1.19.18+dfsg-0.11:1.19.19+dfsg-0+deb7u11:1.19.19+dfsg-11:1.19.20+dfsg-0+deb7u11:1.19.5-11:1.19.5-1+deb7u11:1.19.6-11:1.19.7+dfsg-11:1.19.7+dfsg-1.11:1.19.8+dfsg-11:1.19.8+dfsg-21:1.19.8+dfsg-2.11:1.19.8+dfsg-2.21:1.19.9+dfsg-11:1.19.9+dfsg-2 |
1:1.19.20+dfsg-0+deb7u2 |
mediawikiMageia:4 From an advisory covering 2 CVEs |
before 1.23.7-1.mga4 | 1.23.7-1.mga4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-9277 is a high vulnerability (CVSS 7.5) in Mediawiki, published December 3, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.97%, the 80th percentile. Fixed in mediawiki 1:1.19.20+dfsg-2.1.