CVE-2012-2401
CVE-2012-2401
Esta página presenta datos de fuentes públicas de vulnerabilidades. Consulta el aviso original antes de actualizar.
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.
EPSS 3,4% · Corrección disponible
- Publicación
- Actualización
Pila tecnológica: system
Productos y versiones afectados
n/a
- Versiones
- n/a: Afectada
Sin corrección publicada
wordpress Debian:12
- Intervalos de versiones afectados
- ECOSYSTEM: < 3.3.2+dfsg-1
Actualiza a 3.3.2+dfsg-1
wordpress Debian:13
- Intervalos de versiones afectados
- ECOSYSTEM: < 3.3.2+dfsg-1
Actualiza a 3.3.2+dfsg-1
wordpress Debian:14
- Intervalos de versiones afectados
- ECOSYSTEM: < 3.3.2+dfsg-1
Actualiza a 3.3.2+dfsg-1
Fuentes originales
- http://osvdb.org/81461
- http://secunia.com/advisories/49138
- http://www.plupload.com/punbb/viewtopic.php?id=1685
- http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload?rev=20487
- https://exchange.xforce.ibmcloud.com/vulnerabilities/75208
- http://www.debian.org/security/2012/dsa-2470
- https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/
- http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload/changelog.txt?rev=20487
- http://www.securityfocus.com/bid/53192
- http://wordpress.org/news/2012/04/wordpress-3-3-2/
- https://nvd.nist.gov/vuln/detail/CVE-2012-2401