PT-2014-2223 · Amcharts · Amcharts Flash

Published 2014-12-28 · Updated 2014-12-29 · CVE-2012-1303

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions amCharts Flash 1

Description The issue allows remote attackers to inject arbitrary web script or HTML, potentially leading to cross-site scripting (XSS) attacks. This can be achieved through various parameters, including data file or settings file to ampie.swf, the message element in the chart data parameter to amcolumn.swf, amline.swf, amradar.swf, or amxy.swf, or the settings file parameter to amstock.swf. API Endpoints are not explicitly mentioned, but the parameters data file, settings file, and chart data are vulnerable. The message element within chart data is specifically highlighted as a point of vulnerability.

Recommendations For amCharts Flash 1, consider disabling the use of the data file, settings file, and chart data parameters until a patch is available. Restrict access to the ampie.swf, amcolumn.swf, amline.swf, amradar.swf, amxy.swf, and amstock.swf files to minimize the risk of exploitation. Avoid using the message element within the chart data parameter in the affected SWF files until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2012-1303

Affected Products

Amcharts Flash

References · 3

• 🔥 http://web.appsec.ws/FlashExploitDatabase.php · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2012-1303 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-1303 · Note