The wfMangleFlashPolicy function in OutputHandler.php in MediaWiki before 1.19.22, 1.20.x through 1.22.x before 1.22.14, and 1.23.x before 1.23.7 allows remote attackers to conduct PHP object injection attacks via a crafted string containing <cross-domain-policy> in a PHP format request, which causes the string length to change when converting the request to <NOT-cross-domain-policy>.

The version of MediaWiki installed is 1.23.x earlier than 1.23.7 and is affected by multiple vulnerabilities :

 - A flaw exists that allows a reflected cross-site scripting (XSS) attack. This flaw exists because 'Special:ExpandTemplates' does not validate input to the 'wpInput' parameter before rendering it in raw HTML and returning it to users. This may allow a context-dependent attacker to create a specially crafted request that would execute arbitrary script code in a user's browser session within the trust relationship between their browser and the server. (CVE-2014-9276)
 - A flaw in the 'wfMangleFlashPolicy()' function in the 'OutputHandler.php' script is triggered as API output that contains 'cross-domain-policy' becomes corrupted when being handled by the aforementioned function. This may allow a remote attacker to more easily bypass intended cross-domain-policy restrictions. (CVE-2014-9277)

The remote host is affected by the vulnerability described in GLSA-201502-04 (MediaWiki: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in MediaWiki. Please       review the CVE identifiers and MediaWiki announcement referenced below       for details.
  Impact :

    A remote attacker may be able to execute arbitrary code with the       privileges of the process, create a Denial of Service condition, obtain       sensitive information, bypass security restrictions, and inject arbitrary       web script or HTML.
  Workaround :

    There is no known workaround at this time.

According to its version number, the MediaWiki application running on the remote host is affected by the following vulnerabilities :

  - An input validation error exists related to handling     previews of wikitext that allows cross-site scripting     attacks. (CVE-2014-9276)

  - An input validation error exists related to flash policy     mangling, API clients, and 'format=php' that allows     cross-site scripting. (CVE-2014-9277)

  - An error exists related to 'content model' editing that     allows a remote, unprivileged attacker to modify a     user's 'common.js' file. (Bug 70901)

  - An error exists related to deleting an entry. The     'DELETED_ACTION' and the action 'revdeleted' allows     information disclosure via log files. (Bug 72222)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated mediawiki packages fix security vulnerabilies :

In MediaWiki before 1.23.7, a missing CSRF check could allow reflected XSS on wikis that allow raw HTML (CVE-2014-9276).

MediaWiki's mangling, in MediaWiki before 1.23.7, could allow an article editor to inject code into API consumers that blindly unserialize PHP representations of the page from the API (CVE-2014-9277).

This update provides MediaWiki 1.23.7, which fixes these security issues and other bugs.

A flaw was discovered in mediawiki, a wiki engine: cross-domain-policy mangling allows an article editor to inject code into API consumers that deserialize PHP representations of the page from the API.

ID	Name	Product	Family	Severity
9476	MediaWiki < 1.23.7 Multiple Vulnerabilities	Nessus Network Monitor	CGI	high
81227	GLSA-201502-04 : MediaWiki: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
80121	MediaWiki < 1.19.22 / 1.22.14 / 1.23.7 Multiple Vulnerabilities	Nessus	CGI abuses	high
79986	Mandriva Linux Security Advisory : mediawiki (MDVSA-2014:241)	Nessus	Mandriva Local Security Checks	high
79887	Debian DSA-3100-1 : mediawiki - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2014-9277

critical

Tenable Plugins

high

critical

high

high

high