SWFUpload contains a flaw that allows a remote cross-site scripting (XSS) attack. This flaw exists because the application does not validate the 'movieName' parameter upon submission to the swfupload.swf script when making a call to ExternalInterface.call(). This may allow a user to create a specially crafted request that would execute arbitrary script code in a user's browser within the trust relationship between their browser and the server.

OSVDB is not aware of a solution for this vulnerability.

• CVE ID: 2012-3414 (see also: NVD)
• Secunia Advisory ID: 49651 49761 49780 50001 50302 50488 51224 51249 51250 51271 51387 51389 51391 52535 52540 52548 52553
• Bugtraq ID: 54245
• ISS X-Force ID: 80234 80249
• Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2013-04/0200.html
  http://seclists.org/fulldisclosure/2012/Nov/162
• Other Advisory URL: http://code.google.com/p/swfupload/issues/detail?id=376
  http://websecurity.com.ua/6157/
  https://nealpoole.com/blog/2012/05/xss-and-csrf-via-swf-applets-swfupload-plupload/
• Vendor Specific News/Changelog Entry: http://community.invisionpower.com/topic/365121-ipboard-32-33x-security-update-for-plug-in/
  http://info.tiki.org/article198-Tiki-8-5-and-9-1-Released
  http://wordpress.org/extend/plugins/nextgen-gallery/changelog/
  http://wordpress.org/extend/plugins/ultimate-tinymce/changelog/
  http://wordpress.org/extend/plugins/wp-carouselslideshow/changelog/
  http://wordpress.org/extend/plugins/wysija-newsletters/changelog/
  http://www.concrete5.org/documentation/background/version_history/5-6-0-release-notes/
  http://xenforo.com/community/threads/xenforo-1-1-3-released-includes-security-fix.32891/
• Packet Storm: http://packetstormsecurity.com/files/121291/Dotclear-2.4.4-Cross-Site-Scripting-Content-Spoofing.html
  http://packetstormsecurity.com/files/121348/SWFUpload-CSRF-XSS-Object-Injection.html
  http://packetstormsecurity.org/files/115690/gwebmail-xsslfiexec.txt
  http://packetstormsecurity.org/files/118343/SWF-Upload-f10-f11-Cross-Site-Scripting.html
• Vendor Specific Advisory URL: http://typo3.org/teams/security/security-bulletins/typo3-core/typo3-core-sa-2012-003/
  http://xenforo.com/community/threads/xenforo-security-fix-for-1-0-0-1-1-2.32890/
• Vendor Specific Solution URL: https://github.com/LukasReschke/concrete5/commit/f38a0a70cd6f3fd115e960719220221248c198e7
• Vendor URL: https://www.gwebmail.net/

• Nathan Partlan
• Neal Poole

NVD does not currently have a CVSSv2 score assigned.