CVE-2012-2401
Publicada el · Actualizada el
Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.
3Vexday Risk Score
Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.
ssvc Trackepss 3.5%
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.
Productos afectados
n/a · n/aReferencias
http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload/changelog.txt?rev=20487http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload?rev=20487http://osvdb.org/81461http://secunia.com/advisories/49138https://exchange.xforce.ibmcloud.com/vulnerabilities/75208https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/http://wordpress.org/news/2012/04/wordpress-3-3-2/http://www.debian.org/security/2012/dsa-2470http://www.plupload.com/punbb/viewtopic.php?id=1685http://www.securityfocus.com/bid/53192