CVE-2012-3414
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Im… (CVE-2012-3414)
noneEPSS 9.1%
Description
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.
Metrics
Severity
none
56.98
no public PoC known
95.0 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
Published
2013-07-19 10:00 UTC
—
Affected products
Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.
swfupload_project
swfupload2.2.0.1
swfupload_project
swfupload
tinymce
image_manager
wordpress
wordpress3.3.1
wordpress
wordpress
References & sources
- http://code.google.com/p/swfupload/issues/detail?id=376x_refsource_MISC
- http://www.securityfocus.com/bid/54245vdb-entryx_refsource_BID
- http://www.openwall.com/lists/oss-security/2012/07/17/12mailing-listx_refsource_MLIST
- http://bot24.blogspot.ca/2013/04/swfupload-object-injectioncsrf.htmlx_refsource_MISC
- https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/x_refsource_MISC
- http://www.openwall.com/lists/oss-security/2012/07/16/4mailing-listx_refsource_MLIST
- http://make.wordpress.org/core/2013/06/21/secure-swfupload/x_refsource_CONFIRM
- http://packetstormsecurity.com/files/122399/TinyMCE-Image-Manager-1.1-Cross-Site-Scripting.htmlx_refsource_MISC
IDCVE-2012-3414