CVE-2012-2399 WordPress Core <= 3.5.1 - Cross-Site Scripting
HighCVSS 10.0
EPSS 8.9%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/wordpress(Debian:12) | < 3.3.2+dfsg-1 | 3.3.2+dfsg-1 |
| debian/wordpress(Debian:13) | < 3.3.2+dfsg-1 | 3.3.2+dfsg-1 |
| debian/wordpress(Debian:14) | < 3.3.2+dfsg-1 | 3.3.2+dfsg-1 |
| WordPress | <= 3.3.1 | No fix listed |
| WordPress | = 0.71 | No fix listed |
| WordPress | = 1.0 | No fix listed |
| WordPress | = 1.0.1 | No fix listed |
| WordPress | = 1.0.2 | No fix listed |
| WordPress | = 1.1.1 | No fix listed |
| WordPress | = 1.2 | No fix listed |
| WordPress | = 1.2.1 | No fix listed |
| WordPress | = 1.2.2 | No fix listed |
| WordPress | = 1.2.3 | No fix listed |
| WordPress | = 1.2.4 | No fix listed |
| WordPress | = 1.2.5 | No fix listed |
| WordPress | = 1.2.5-a | No fix listed |
| WordPress | = 1.3 | No fix listed |
| WordPress | = 1.3.2 | No fix listed |
| WordPress | = 1.3.3 | No fix listed |
| WordPress | = 1.5 | No fix listed |
| WordPress | = 1.5.1 | No fix listed |
| WordPress | = 1.5.1.1 | No fix listed |
| WordPress | = 1.5.1.2 | No fix listed |
| WordPress | = 1.5.1.3 | No fix listed |
| WordPress | = 1.5.2 | No fix listed |
Show 59 more
| Product | Affected versions | Fixed in |
|---|---|---|
| WordPress | = 2.0 | No fix listed |
| WordPress | = 2.0.1 | No fix listed |
| WordPress | = 2.0.2 | No fix listed |
| WordPress | = 2.0.4 | No fix listed |
| WordPress | = 2.0.5 | No fix listed |
| WordPress | = 2.0.6 | No fix listed |
| WordPress | = 2.0.7 | No fix listed |
| WordPress | = 2.0.8 | No fix listed |
| WordPress | = 2.0.9 | No fix listed |
| WordPress | = 2.0.10 | No fix listed |
| WordPress | = 2.0.11 | No fix listed |
| WordPress | = 2.1 | No fix listed |
| WordPress | = 2.1.1 | No fix listed |
| WordPress | = 2.1.2 | No fix listed |
| WordPress | = 2.1.3 | No fix listed |
| WordPress | = 2.2 | No fix listed |
| WordPress | = 2.2.1 | No fix listed |
| WordPress | = 2.2.2 | No fix listed |
| WordPress | = 2.2.3 | No fix listed |
| WordPress | = 2.3 | No fix listed |
| WordPress | = 2.3.1 | No fix listed |
| WordPress | = 2.3.2 | No fix listed |
| WordPress | = 2.3.3 | No fix listed |
| WordPress | = 2.5 | No fix listed |
| WordPress | = 2.5.1 | No fix listed |
| WordPress | = 2.6 | No fix listed |
| WordPress | = 2.6.1 | No fix listed |
| WordPress | = 2.6.2 | No fix listed |
| WordPress | = 2.6.3 | No fix listed |
| WordPress | = 2.6.5 | No fix listed |
| WordPress | = 2.7 | No fix listed |
| WordPress | = 2.7.1 | No fix listed |
| WordPress | = 2.8 | No fix listed |
| WordPress | = 2.8.1 | No fix listed |
| WordPress | = 2.8.2 | No fix listed |
| WordPress | = 2.8.3 | No fix listed |
| WordPress | = 2.8.4 | No fix listed |
| WordPress | = 2.8.4-a | No fix listed |
| WordPress | = 2.8.5 | No fix listed |
| WordPress | = 2.8.5.1 | No fix listed |
| WordPress | = 2.8.5.2 | No fix listed |
| WordPress | = 2.8.6 | No fix listed |
| WordPress | = 2.9 | No fix listed |
| WordPress | = 2.9.1 | No fix listed |
| WordPress | = 2.9.1.1 | No fix listed |
| WordPress | = 2.9.2 | No fix listed |
| WordPress | = 3.0 | No fix listed |
| WordPress | = 3.0.1 | No fix listed |
| WordPress | = 3.0.2 | No fix listed |
| WordPress | = 3.0.3 | No fix listed |
| WordPress | = 3.0.4 | No fix listed |
| WordPress | = 3.0.5 | No fix listed |
| WordPress | = 3.0.6 | No fix listed |
| WordPress | = 3.1 | No fix listed |
| WordPress | = 3.1.1 | No fix listed |
| WordPress | = 3.1.2 | No fix listed |
| WordPress | = 3.1.3 | No fix listed |
| WordPress | = 3.3 | No fix listed |
| WordPress(WordPress) | < 3.5.2 | 3.5.2 |
References
- Debian Security Tracker CVE-2012-2399 vendor-advisory
- core.trac.wordpress.org
- JVN#25280162 third-party-advisory
- JVNDB-2012-002110 third-party-advisory
- make.wordpress.org
- 81459 vdb-entry
- packetstormsecurity.com
- packetstormsecurity.com
- 20130310 CS and XSS vulnerabilities in SWFUpload mailing-list
- 49138 third-party-advisory
- wordpress.org patch vendor-advisory
- DSA-2470 vendor-advisory
- [oss-security] 20130718 Re: Re: SWFUpload <= (Object Injection/CSRF) Vulnerabilities Multiple flaws mailing-list
- 91134 vdb-entry
- 53192 vdb-entry
- wordpress-swfupload-unspecified(75210) vdb-entry
- Wordfence Intelligence third-party-advisory
- www.cve.org
- bugs.debian.org issue-tracking