Description
Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFUpload 2.2.0.1 and earlier, as used in WordPress before 3.3.2, TinyMCE Image Manager 1.1, and other products, allows remote attackers to inject arbitrary web script or HTML via the movieName parameter, related to the "ExternalInterface.call" function.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | wordpress | 3.5.1+dfsg-1 | — |
| Debian 13 | wordpress | 3.5.1+dfsg-1 | — |
| Debian 12 | wordpress | 3.5.1+dfsg-1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- SWFupload - 'movieName' Cross-Site Scripting EDB-37470 · webapps · Jun 29, 2012 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- http://code.google.com/p/swfupload/issues/detail?id=376
- 54245 vdb-entry
- [oss-security] 20120717 Re: CVE id request: libjs-swfupload mailing-list
- http://bot24.blogspot.ca/2013/04/swfupload-object-injectioncsrf.html
- https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/
- [oss-security] 20120716 CVE id request: libjs-swfupload mailing-list
- http://make.wordpress.org/core/2013/06/21/secure-swfupload/
- http://packetstormsecurity.com/files/122399/TinyMCE-Image-Manager-1.1-Cross-Site-Scripting.html