Description

Plupload before 1.5.4, as used in wp-includes/js/plupload/ in WordPress before 3.3.2 and other products, enables scripting regardless of the domain from which the SWF content was loaded, which allows remote attackers to bypass the Same Origin Policy via crafted content.

Remediation

References

CVE-2012-2401

Related Vulnerabilities

TYPO3 Improper Authentication Vulnerability (CVE-2014-3945)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2021-36131)

Dotclear Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2016-9891)

Jboss EAP Deserialization of Untrusted Data Vulnerability (CVE-2019-14893)

Django Improper Input Validation Vulnerability (CVE-2012-3443)

Severity

Medium

Classification

CVE-2012-2401 CWE-264

Tags

Missing Update Known Vulnerabilities