PT-2015-4175 · Wikimedia+1 · Mediawiki+1

Pleasestand · Published 2014-12-03 · Updated 2015-01-06 · CVE-2014-9277

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.19.22 MediaWiki versions 1.20.x through 1.22.x before 1.22.14 MediaWiki versions 1.23.x before 1.23.7

Description The issue allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request. This occurs because the wfMangleFlashPolicy function in OutputHandler.php causes the string length to change when converting the request to <NOT-cross-domain-policy>.

Recommendations For MediaWiki versions prior to 1.19.22, update to version 1.19.22 or later. For MediaWiki versions 1.20.x through 1.22.x before 1.22.14, update to version 1.22.14 or later. For MediaWiki versions 1.23.x before 1.23.7, update to version 1.23.7 or later.

Exploit

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

ALT-PU-2014-2433

CVE-2014-9277

DSA-3100-1

MGASA-2014-0506

Affected Products

Alt Linux

Mediawiki

References · 19

• 🔥 https://phabricator.wikimedia.org/T73478 · Exploit
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9277 · Security Note
• https://advisories.mageia.org/MGASA-2014-0506.html · Security Note
• https://lists.wikimedia.org/pipermail/mediawiki-announce/2014-November/000170.html · Vendor Advisory
• https://errata.altlinux.org/ALT-PU-2014-2433 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9277 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9276 · Security Note
• http://debian.org/security/2014/dsa-3100 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2014-9277 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-9277 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2014-9277 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0506 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9507 · Security Note
• https://bugs.mageia.org/show_bug.cgi?id=14711 · Note
• http://securitytracker.com/id?1031301 · Note