CVE-2014-9277

The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote…

published January 4, 2015

CVSS
—
EPSS
2%
Percentile
80.1
In the wild
Unconfirmed
What it is

The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request, which causes the string length to change when converting the request to <NOT-cross-domain-policy>.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01965 · 80.1th percentile
Published
2015-01-04T21:00Z
EPSS history
Timeline
  • 04 JAN 21:00Z
    The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote…
    cvelistv5