Skip to content

CVE-2012-2401 WordPress Core <= 3.3.1 - Same Origin Policy Bypass

MediumCVSS 5.0 EPSS 3.5%
Published
Updated
Exploit status
No public exploit known
Sign in for asset impact Search another CVE

Description

Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.

Affected products

ProductAffected versionsFixed in
WordPress(WordPress) < 3.3.2 3.3.2
debian/wordpress(Debian:12) < 3.3.2+dfsg-1 3.3.2+dfsg-1
debian/wordpress(Debian:13) < 3.3.2+dfsg-1 3.3.2+dfsg-1
debian/wordpress(Debian:14) < 3.3.2+dfsg-1 3.3.2+dfsg-1
moxiecode plupload <= 1.5.3 No fix listed
moxiecode plupload = 1.4.0 No fix listed
moxiecode plupload = 1.4.1 No fix listed
moxiecode plupload = 1.4.2 No fix listed
moxiecode plupload = 1.4.3 No fix listed
moxiecode plupload = 1.5.0 No fix listed
moxiecode plupload = 1.5.0-beta No fix listed
moxiecode plupload = 1.5.1 No fix listed
moxiecode plupload = 1.5.2 No fix listed
WordPress <= 3.3.1 No fix listed
WordPress = 0.71 No fix listed
WordPress = 1.0 No fix listed
WordPress = 1.0.1 No fix listed
WordPress = 1.0.2 No fix listed
WordPress = 1.1.1 No fix listed
WordPress = 1.2 No fix listed
WordPress = 1.2.1 No fix listed
WordPress = 1.2.2 No fix listed
WordPress = 1.2.3 No fix listed
WordPress = 1.2.4 No fix listed
WordPress = 1.2.5 No fix listed
Show 68 more
ProductAffected versionsFixed in
WordPress = 1.2.5-a No fix listed
WordPress = 1.3 No fix listed
WordPress = 1.3.2 No fix listed
WordPress = 1.3.3 No fix listed
WordPress = 1.5 No fix listed
WordPress = 1.5.1 No fix listed
WordPress = 1.5.1.1 No fix listed
WordPress = 1.5.1.2 No fix listed
WordPress = 1.5.1.3 No fix listed
WordPress = 1.5.2 No fix listed
WordPress = 2.0 No fix listed
WordPress = 2.0.1 No fix listed
WordPress = 2.0.2 No fix listed
WordPress = 2.0.4 No fix listed
WordPress = 2.0.5 No fix listed
WordPress = 2.0.6 No fix listed
WordPress = 2.0.7 No fix listed
WordPress = 2.0.8 No fix listed
WordPress = 2.0.9 No fix listed
WordPress = 2.0.10 No fix listed
WordPress = 2.0.11 No fix listed
WordPress = 2.1 No fix listed
WordPress = 2.1.1 No fix listed
WordPress = 2.1.2 No fix listed
WordPress = 2.1.3 No fix listed
WordPress = 2.2 No fix listed
WordPress = 2.2.1 No fix listed
WordPress = 2.2.2 No fix listed
WordPress = 2.2.3 No fix listed
WordPress = 2.3 No fix listed
WordPress = 2.3.1 No fix listed
WordPress = 2.3.2 No fix listed
WordPress = 2.3.3 No fix listed
WordPress = 2.5 No fix listed
WordPress = 2.5.1 No fix listed
WordPress = 2.6 No fix listed
WordPress = 2.6.1 No fix listed
WordPress = 2.6.2 No fix listed
WordPress = 2.6.3 No fix listed
WordPress = 2.6.5 No fix listed
WordPress = 2.7 No fix listed
WordPress = 2.7.1 No fix listed
WordPress = 2.8 No fix listed
WordPress = 2.8.1 No fix listed
WordPress = 2.8.2 No fix listed
WordPress = 2.8.3 No fix listed
WordPress = 2.8.4 No fix listed
WordPress = 2.8.4-a No fix listed
WordPress = 2.8.5 No fix listed
WordPress = 2.8.5.1 No fix listed
WordPress = 2.8.5.2 No fix listed
WordPress = 2.8.6 No fix listed
WordPress = 2.9 No fix listed
WordPress = 2.9.1 No fix listed
WordPress = 2.9.1.1 No fix listed
WordPress = 2.9.2 No fix listed
WordPress = 3.0 No fix listed
WordPress = 3.0.1 No fix listed
WordPress = 3.0.2 No fix listed
WordPress = 3.0.3 No fix listed
WordPress = 3.0.4 No fix listed
WordPress = 3.0.5 No fix listed
WordPress = 3.0.6 No fix listed
WordPress = 3.1 No fix listed
WordPress = 3.1.1 No fix listed
WordPress = 3.1.2 No fix listed
WordPress = 3.1.3 No fix listed
WordPress = 3.3 No fix listed

References