VDB
CVE-2012-2399
CVE-2012-2399
PUBLISHED
CVSS 10 CRITICAL
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414.
EPSS 3.86% · 88.4th percentile
Risk Scores
CVSS 2.0
10
EPSS Score
3.86%
88.4th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| wordpress | wordpress | 1.2.4, 1.0.2, 0 |
| n/a | n/a | n/a |
Timeline
- Apr 21, 2012 CVE Published
- Jan 23, 2014 PoC Published
- Feb 4, 2022 EPSS Score
- May 20, 2022 EPSS Score
- Jul 12, 2022 EPSS Score
- Oct 26, 2022 EPSS Score
- Dec 18, 2022 EPSS Score
- Mar 7, 2023 EPSS Score
- May 25, 2023 EPSS Score
- Jul 17, 2023 EPSS Score
- Oct 30, 2023 EPSS Score
- Feb 12, 2024 EPSS Score
References
- http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/swfupload/swfupload.swf?rev=20503 url
- wordpress-swfupload-unspecified(75210) vdb
- 81459 vdb
- 49138 third-party-advisory
- http://packetstormsecurity.com/files/122399/tinymce11-xss.txt url
- 91134 vdb
- DSA-2470 vendor-advisory
- http://packetstormsecurity.com/files/120746/SWFUpload-Content-Spoofing-Cross-Site-Scripting.html url
- [oss-security] 20130718 Re: Re: SWFUpload <= (Object Injection/CSRF) Vulnerabilities Multiple flaws mailing-list
- http://make.wordpress.org/core/2013/06/21/secure-swfupload/ url
- 53192 vdb
- http://wordpress.org/news/2012/04/wordpress-3-3-2/ url
- JVNDB-2012-002110 third-party-advisory
- JVN#25280162 third-party-advisory
- 20130310 CS and XSS vulnerabilities in SWFUpload mailing-list
- https://nvd.nist.gov/vuln/detail/CVE-2012-2399 advisory
- http://make.wordpress.org/core/2013/06/21/secure-swfupload url
- http://wordpress.org/news/2012/04/wordpress-3-3-2 url