CVE-2012-2401
published 2012-04-21CVE-2012-2401: Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which…
PriorityP427medium5CVSS 2.0
AVNACLAuNCNIPAN
EPSS
5.32%
91.7th percentile
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.
Affected
91 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | wordpress | < wordpress 3.3.2+dfsg-1 (bookworm) | wordpress 3.3.2+dfsg-1 (bookworm) |
| moxiecode | plupload | <= 1.5.3 | — |
| moxiecode | plupload | — | — |
| moxiecode | plupload | — | — |
| moxiecode | plupload | — | — |
| moxiecode | plupload | — | — |
| moxiecode | plupload | — | — |
| moxiecode | plupload | — | — |
| moxiecode | plupload | — | — |
| wordpress | wordpress | <= 3.3.1 | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
| wordpress | wordpress | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:P/A:N
osv5.0MEDIUM
vendor_debian5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-ch8h-4j2v-gwvg: Plupload before 1
ghsa_unreviewed·2022-05-17
CVE-2012-2401 [MEDIUM] GHSA-ch8h-4j2v-gwvg: Plupload before 1
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.
OSV
CVE-2012-2401: Plupload before 1
osv·2012-04-21·CVSS 5.0
CVE-2012-2401 [MEDIUM] CVE-2012-2401: Plupload before 1
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.
Debian
CVE-2012-2401: wordpress - Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3...
vendor_debian·2012·CVSS 5.0
CVE-2012-2401 [MEDIUM] CVE-2012-2401: wordpress - Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3...
Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.
Scope: local
bookworm: resolved (fixed in 3.3.2+dfsg-1)
bullseye: resolved (fixed in 3.3.2+dfsg-1)
forky: resolved (fixed in 3.3.2+dfsg-1)
sid: resolved (fixed in 3.3.2+dfsg-1)
trixie: resolved (fixed in 3.3.2+dfsg-1)
No detection rules found.
No public exploits indexed.
http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload/changelog.txt?rev=20487http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload?rev=20487http://osvdb.org/81461http://secunia.com/advisories/49138http://wordpress.org/news/2012/04/wordpress-3-3-2/http://www.debian.org/security/2012/dsa-2470http://www.plupload.com/punbb/viewtopic.php?id=1685http://www.securityfocus.com/bid/53192https://exchange.xforce.ibmcloud.com/vulnerabilities/75208https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload/changelog.txt?rev=20487http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload?rev=20487http://osvdb.org/81461http://secunia.com/advisories/49138http://wordpress.org/news/2012/04/wordpress-3-3-2/http://www.debian.org/security/2012/dsa-2470http://www.plupload.com/punbb/viewtopic.php?id=1685http://www.securityfocus.com/bid/53192https://exchange.xforce.ibmcloud.com/vulnerabilities/75208https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/
2012-04-21
Published