CVE-2014-9277: Mediawiki

High severity, CVSS 7.5. EPSS: 2% chance of exploitation in the next 30 days.

The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request, which causes the string length to change when converting the request to <NOT-cross-domain-policy>.

Affected products

• Mediawiki Mediawiki: up to and including 1.19.21; version 1.20 only; version 1.20.1 only; version 1.20.2 only; version 1.20.3 only; version 1.20.4 only; …

Published 2015-01-04. Last modified 2026-06-17.