CVE-2012-2399 | Vulnetix

CVE-2012-2399 PUBLISHED CVSS 10 CRITICAL

Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414.

EPSS 8.58% · 95.0th percentile

Risk Scores

CVSS 2.0

EPSS Score

8.58%

95.0th percentile

Affected Products

Vendor	Product	Versions
wordpress	wordpress	1.2.4, 1.0.2, 0
n/a	n/a	n/a

Timeline

Apr 21, 2012 CVE Published
Jan 23, 2014 PoC Published
Feb 4, 2022 EPSS Score
May 21, 2022 EPSS Score
Jul 13, 2022 EPSS Score
Oct 27, 2022 EPSS Score
Feb 10, 2023 EPSS Score
Mar 7, 2023 EPSS Score
May 27, 2023 EPSS Score
Sep 9, 2023 EPSS Score
Nov 1, 2023 EPSS Score
Feb 15, 2024 EPSS Score

References

http://wordpress.org/news/2012/04/wordpress-3-3-2/ url
JVNDB-2012-002110 third-party-advisory
20130310 CS and XSS vulnerabilities in SWFUpload mailing-list
http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/swfupload/swfupload.swf?rev=20503 url
49138 third-party-advisory
[oss-security] 20130718 Re: Re: SWFUpload <= (Object Injection/CSRF) Vulnerabilities Multiple flaws mailing-list
JVN#25280162 third-party-advisory
https://nvd.nist.gov/vuln/detail/CVE-2012-2399 advisory
http://make.wordpress.org/core/2013/06/21/secure-swfupload url
http://packetstormsecurity.com/files/120746/SWFUpload-Content-Spoofing-Cross-Site-Scripting.html url
http://wordpress.org/news/2012/04/wordpress-3-3-2 url
http://www.securityfocus.com/bid/53192 url
http://make.wordpress.org/core/2013/06/21/secure-swfupload/ technical
http://www.debian.org/security/2012/dsa-2470 technical
https://exchange.xforce.ibmcloud.com/vulnerabilities/75210 technical
http://osvdb.org/81459 technical
http://packetstormsecurity.com/files/122399/tinymce11-xss.txt technical
http://www.osvdb.org/91134 technical

Open in Interactive Console →