CVE-2012-2399

Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414.

Published Bycve@mitre.org

Published DateApr 21, 2012, 23:55

Weakness Type (CWE):NVD-CWE-noinfo

CVSS Metrics

Base Score

Vector String

AV:N/AC:L/Au:N/C:C/I:C/A:C

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

COMPLETE

Integrity (I)

COMPLETE

Availability (A)

COMPLETE

References

http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/swfupload/swfupload.swf?rev=20503
http://jvn.jp/en/jp/JVN25280162/index.html
http://jvndb.jvn.jp/jvndb/JVNDB-2012-002110
http://make.wordpress.org/core/2013/06/21/secure-swfupload/
http://osvdb.org/81459
http://packetstormsecurity.com/files/120746/SWFUpload-Content-Spoofing-Cross-Site-Scripting.html
http://packetstormsecurity.com/files/122399/tinymce11-xss.txt
http://seclists.org/fulldisclosure/2013/Mar/110
http://secunia.com/advisories/49138
http://wordpress.org/news/2012/04/wordpress-3-3-2/
http://www.debian.org/security/2012/dsa-2470
http://www.openwall.com/lists/oss-security/2013/07/18/13
http://www.osvdb.org/91134
http://www.securityfocus.com/bid/53192
https://exchange.xforce.ibmcloud.com/vulnerabilities/75210

Weakness Type (CWE):NVD-CWE-noinfo

CVSS Metrics

Base Score

Vector String

AV:N/AC:L/Au:N/C:C/I:C/A:C

Base Severity

Version

2.0

Attack Vector (AV)

Attack Complexity (AC)

Privileges Required (PR)

User Interaction (UI)

Scope (S)

Confidentiality (C)

COMPLETE

Integrity (I)

COMPLETE

Availability (A)

COMPLETE