Vulnerability-Lookup - Search a vulnerability

Vulnerabilites related to tinymce - image_manager

CVE-2012-3414 (GCVE-0-2012-3414)

Vulnerability from cvelistv5

Published

2013-07-19 10:00

Modified

2024-08-06 20:05

Severity ?

CWE

Summary

Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.

References

►

URL

Tags

	http://code.google.com/p/swfupload/issues/detail?id=376	x_refsource_MISC
	http://www.securityfocus.com/bid/54245	vdb-entry, x_refsource_BID
	http://www.openwall.com/lists/oss-security/2012/07/17/12	mailing-list, x_refsource_MLIST
	http://bot24.blogspot.ca/2013/04/swfupload-object-injectioncsrf.html	x_refsource_MISC
	https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/	x_refsource_MISC
	http://www.openwall.com/lists/oss-security/2012/07/16/4	mailing-list, x_refsource_MLIST
	http://make.wordpress.org/core/2013/06/21/secure-swfupload/	x_refsource_CONFIRM
	http://packetstormsecurity.com/files/122399/TinyMCE-Image-Manager-1.1-Cross-Site-Scripting.html	x_refsource_MISC

Impacted products

	Vendor	Product	Version
	n/a	n/a	Version: n/a

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-06T20:05:12.282Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://code.google.com/p/swfupload/issues/detail?id=376"
          },
          {
            "name": "54245",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/54245"
          },
          {
            "name": "[oss-security] 20120717 Re: CVE id request: libjs-swfupload",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/07/17/12"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://bot24.blogspot.ca/2013/04/swfupload-object-injectioncsrf.html"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/"
          },
          {
            "name": "[oss-security] 20120716 CVE id request: libjs-swfupload",
            "tags": [
              "mailing-list",
              "x_refsource_MLIST",
              "x_transferred"
            ],
            "url": "http://www.openwall.com/lists/oss-security/2012/07/16/4"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://make.wordpress.org/core/2013/06/21/secure-swfupload/"
          },
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "http://packetstormsecurity.com/files/122399/TinyMCE-Image-Manager-1.1-Cross-Site-Scripting.html"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2012-05-17T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the \"ExternalInterface.call\" function."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2016-12-06T18:57:01",
        "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
        "shortName": "redhat"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://code.google.com/p/swfupload/issues/detail?id=376"
        },
        {
          "name": "54245",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/54245"
        },
        {
          "name": "[oss-security] 20120717 Re: CVE id request: libjs-swfupload",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/07/17/12"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://bot24.blogspot.ca/2013/04/swfupload-object-injectioncsrf.html"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/"
        },
        {
          "name": "[oss-security] 20120716 CVE id request: libjs-swfupload",
          "tags": [
            "mailing-list",
            "x_refsource_MLIST"
          ],
          "url": "http://www.openwall.com/lists/oss-security/2012/07/16/4"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://make.wordpress.org/core/2013/06/21/secure-swfupload/"
        },
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "http://packetstormsecurity.com/files/122399/TinyMCE-Image-Manager-1.1-Cross-Site-Scripting.html"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secalert@redhat.com",
          "ID": "CVE-2012-3414",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the \"ExternalInterface.call\" function."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://code.google.com/p/swfupload/issues/detail?id=376",
              "refsource": "MISC",
              "url": "http://code.google.com/p/swfupload/issues/detail?id=376"
            },
            {
              "name": "54245",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/54245"
            },
            {
              "name": "[oss-security] 20120717 Re: CVE id request: libjs-swfupload",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2012/07/17/12"
            },
            {
              "name": "http://bot24.blogspot.ca/2013/04/swfupload-object-injectioncsrf.html",
              "refsource": "MISC",
              "url": "http://bot24.blogspot.ca/2013/04/swfupload-object-injectioncsrf.html"
            },
            {
              "name": "https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/",
              "refsource": "MISC",
              "url": "https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/"
            },
            {
              "name": "[oss-security] 20120716 CVE id request: libjs-swfupload",
              "refsource": "MLIST",
              "url": "http://www.openwall.com/lists/oss-security/2012/07/16/4"
            },
            {
              "name": "http://make.wordpress.org/core/2013/06/21/secure-swfupload/",
              "refsource": "CONFIRM",
              "url": "http://make.wordpress.org/core/2013/06/21/secure-swfupload/"
            },
            {
              "name": "http://packetstormsecurity.com/files/122399/TinyMCE-Image-Manager-1.1-Cross-Site-Scripting.html",
              "refsource": "MISC",
              "url": "http://packetstormsecurity.com/files/122399/TinyMCE-Image-Manager-1.1-Cross-Site-Scripting.html"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
    "assignerShortName": "redhat",
    "cveId": "CVE-2012-3414",
    "datePublished": "2013-07-19T10:00:00",
    "dateReserved": "2012-06-14T00:00:00",
    "dateUpdated": "2024-08-06T20:05:12.282Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Vulnerability from fkie_nvd