Vulnerability CVE-2012-3414 - CERT Civis.Net

Vulnerability Name:

CVE-2012-3414 (CCN-85748)

Assigned:

2012-06-14

Published:

2013-07-15

Updated:

2016-12-08

Summary:

Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
4.1 Medium (Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:U/RC:UR)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Authentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

4.3 Medium (CCN CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N)
4.1 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N/E:H/RL:U/RC:UR)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Medium Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Other

References:

Source: MISC
Type: Exploit
http://bot24.blogspot.ca/2013/04/swfupload-object-injectioncsrf.html

Source: MISC
Type: UNKNOWN
http://code.google.com/p/swfupload/issues/detail?id=376

Source: MITRE
Type: CNA
CVE-2012-3414

Source: CONFIRM
Type: Vendor Advisory
http://make.wordpress.org/core/2013/06/21/secure-swfupload/

Source: MISC
Type: Exploit
http://packetstormsecurity.com/files/122399/TinyMCE-Image-Manager-1.1-Cross-Site-Scripting.html

Source: CCN
Type: SA56034
osCMax Multiple Vulnerabilities

Source: MLIST
Type: UNKNOWN
[oss-security] 20120716 CVE id request: libjs-swfupload

Source: MLIST
Type: UNKNOWN
[oss-security] 20120717 Re: CVE id request: libjs-swfupload

Source: BID
Type: UNKNOWN
54245

Source: CCN
Type: BID-54245
SWFUpload 'movieName' Parameter Cross Site Scripting Vulnerability

Source: CCN
Type: BID-61368
TinyMCE Image Manager Plugin Cross Site Scripting and Arbitrary File Upload Vulnerabilities

Source: CCN
Type: TinyMCE Image Manager Web Site
TinyMCE Image Manager

Source: XF
Type: UNKNOWN
tinymce-imagemanager-swfupload-spoofing(85748)

Source: MISC
Type: Exploit
https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/

Source: CCN
Type: Packet Storm Security [7-15-2013]
TinyMCE Image Manager 1.1 Cross Site Scripting

Vulnerable Configuration:

Configuration 1:

cpe:/a:swfupload_project:swfupload:1.0.2:*:*:*:*:*:*:*

OR cpe:/a:swfupload_project:swfupload:2.0.2:*:*:*:*:*:*:*

OR cpe:/a:swfupload_project:swfupload:2.1.0:*:*:*:*:*:*:*

OR cpe:/a:swfupload_project:swfupload:2.2.0:*:*:*:*:*:*:*

OR cpe:/a:swfupload_project:swfupload:*:*:*:*:*:*:*:* (Version <= 2.2.0.1)

OR cpe:/a:tinymce:image_manager:1.1:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:-:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.0:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.0.1:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.0.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.0.3:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.0.4:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.0.5:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.0.6:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.1.1:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.1.2:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.1.3:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.1.4:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.2:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.2.1:*:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:3.3:-:*:*:*:*:*:*

OR cpe:/a:wordpress:wordpress:*:*:*:*:*:*:*:* (Version <= 3.3.1)

Configuration CCN 1:

cpe:/a:tinymce:image_manager:1.1:*:*:*:*:*:*:*

Denotes that component is vulnerable