Cross-site scripting (XSS) vulnerability in swfupload.swf in SWFupload 2.2.0.1 and earlier, as used in WordPress before 3.5.2, TinyMCE Image Manager 1.1 and earlier, and other products allows remote attackers to inject arbitrary web script or HTML via the buttonText parameter, a different vulnerability than CVE-2012-3414.

Versions of WordPress prior to 3.3.2 are susceptible to the following vulnerabilities :

 - A flaw exists in the SWFUpload module that allows a remote cross-site scripting (XSS) attack.  This flaw exists because the application does not validate the 'buttonText' parameter upon submission to the 'wp-includes/js/swfupload/swfupload.swf' script. This may allow an attacker to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. (CVE-2012-2399)
 - An unspecified remote issue exists related to the 'wp-includes/js/swfobject.js script'. No further details have been provided. (CVE-2012-2400)
 - A flaw exists in the 'security.allowDomain()' method, which allows any domain to access objects and variables within Flash content.  By embedding the applet on a page, a context-dependent attacker can disclose various information including CSRF tokens if a user is tricked into interacting with the applet. (CVE-2012-2401, CVE-2012-3415)
 - A flaw exists related to the 'wp-admin/plugins.php' script that may allow an attacker to cause a network-wide plugin deactivation. (CVE-2012-2402)
 - Flaws exist that make it easier to perform a remote cross-site scripting (XSS) attack. These flaws exist because the application does not validate certain unspecified input upon submission to both the 'wp-includes/formatting.php' and 'wp-comments-post.php' scripts.  This may allow a user to create a specially crafted URL that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server. (CVE-2012-2403, CVE-2012-2404)

Uploading files related security issues were addressed by the upstream upgrade.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities were identified in WordPress, a web blogging tool. As the CVEs were allocated from releases announcements and specific fixes are usually not identified, it has been decided to upgrade the wordpress package to the latest upstream version instead of backporting the patches.

This means extra care should be taken when upgrading, especially when using third-party plugins or themes, since compatibility may have been impacted along the way. We recommend that users check their install before doing the upgrade.

According to its version number, the WordPress install hosted on the remote web server is affected by multiple vulnerabilities :

  - The application is affected by an unspecified     vulnerability in wp-includes/js/swfupload/swfupload.swf.
    (CVE-2012-2399)

  - The application is affected by an unspecified     vulnerability in wp-includes/js/swfobject.js.
    (CVE-2012-2400)

  - The application contains a version of Plupload prior     to 1.5.4 that enables scripting regardless of the     domain from which the SWF content was loaded, which     allows remote attackers to bypass Same Origin Policy     via crafted content. (CVE-2012-2401)

  - The application is affected by a security bypass     vulnerability. Successfully exploiting this issue     would allow a site administrator to deactivate network     wide plugins. This issue requires the application     to run under a WordPress network. (CVE-2012-2402)

  - The application is prone to multiple cross-site     scripting vulnerabilities. An attacker can use     specially crafted comments and the application is     affected when making URLs clickable.
    (CVE-2012-2403, CVE-2012-2404)

Note that CVE-2011-4898, CVE-2011-4899, CVE-2012-0782, CVE-2012-0937, and CVE-2012-1936 reportedly affect WordPress versions 3.3.1 and prior, however the CVE's are currently disputed without clear solutions. It is recommended you update to the latest available WordPress version.

Note that Nessus has not tested for the issues, but instead has relied only on the application's self-reported version number.

Wordpress reports :

External code has been updated to non-vulnerable versions. In addition the following bugs have been fixed :

- Limited privilege escalation where a site administrator could deactivate network-wide plugins when running a WordPress network under particular circumstances.

- Cross-site scripting vulnerability when making URLs clickable.

- Cross-site scripting vulnerabilities in redirects after posting comments in older browsers, and when filtering URLs.

ID	Name	Product	Family	Severity
9101	WordPress < 3.3.2 Multiple Vulnerabilities	Nessus Network Monitor	CGI	critical
59257	Fedora 17 : wordpress-3.3.2-2.fc17 (2012-6494)	Nessus	Fedora Local Security Checks	critical
59093	Debian DSA-2470-1 : wordpress - several vulnerabilities	Nessus	Debian Local Security Checks	critical
59080	Fedora 16 : wordpress-3.3.2-2.fc16 (2012-6542)	Nessus	Fedora Local Security Checks	critical
59079	Fedora 15 : wordpress-3.3.2-2.fc15 (2012-6511)	Nessus	Fedora Local Security Checks	critical
59048	WordPress < 3.3.2 Multiple Vulnerabilities	Nessus	CGI abuses	critical
58839	FreeBSD : wordpress -- multiple vulnerabilities (b384cc5b-8d56-11e1-8d7b-003067b2972c)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2012-2399

medium

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical