PT-2014-2223 · Amcharts · Amcharts Flash

Publicado 2014-12-28 · Atualizado 2014-12-29 · CVE-2012-1303

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions amCharts Flash 1

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various parameters, including data file or settings file to ampie.swf, the message element in the chart data parameter to amcolumn.swf, amline.swf, amradar.swf, or amxy.swf, or the settings file parameter to amstock.swf. API Endpoints are not explicitly mentioned, but the parameters data file, settings file, and chart data are vulnerable. The message element within chart data is specifically highlighted as a point of vulnerability.

Recommendations For amCharts Flash 1, consider disabling the use of the data file, settings file, and chart data parameters until a patch is available. Restrict access to the ampie.swf, amcolumn.swf, amline.swf, amradar.swf, amxy.swf, and amstock.swf files to minimize the risk of exploitation. Avoid using the message element within the chart data parameter in the affected SWF files until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2012-1303

Produtos afetados

Amcharts Flash

Referências · 3

• 🔥 http://web.appsec.ws/FlashExploitDatabase.php · Exploit
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1303 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2012-1303 · Nota de Segurança