CVE Feed

    Dashboard / CVE / CVE-2012-2401

    CVE-2012-2401

    Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.

    Published:Apr 21, 2012
    Last Modified:Apr 11, 2025
    EPS:Apr 21, 2012
    EPSS Score:0.01014
    CVSS Score:5

    Affected Products

    Vendor
    Moxiecode
    Product
    Plupload
    Vendor
    Wordpress
    Product
    Wordpress

    Exploits

    No exploit reference

    Common Weakness Enumeration

    No CWE recorded yet

    Common Attack Pattern Enumeration and Classification (CAPEC)

    No CAPEC recorded yet

    References

    http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload/changelog.txt?rev=20487
    http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload?rev=20487
    http://osvdb.org/81461
    http://secunia.com/advisories/49138
    http://wordpress.org/news/2012/04/wordpress-3-3-2/
    http://www.debian.org/security/2012/dsa-2470
    http://www.plupload.com/punbb/viewtopic.php?id=1685
    http://www.securityfocus.com/bid/53192
    https://exchange.xforce.ibmcloud.com/vulnerabilities/75208
    https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/
    http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload/changelog.txt?rev=20487
    http://core.trac.wordpress.org/browser/branches/3.3/wp-includes/js/plupload?rev=20487
    http://osvdb.org/81461
    http://secunia.com/advisories/49138
    http://wordpress.org/news/2012/04/wordpress-3-3-2/
    http://www.debian.org/security/2012/dsa-2470
    http://www.plupload.com/punbb/viewtopic.php?id=1685
    http://www.securityfocus.com/bid/53192
    https://exchange.xforce.ibmcloud.com/vulnerabilities/75208
    https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High