Collected research

The old is new, again. CVE20112461 is back!

[TROOPERS15] Luca Carettoni, Mauro Gentile - The old is new, again. CVE20112461 is back

Luca Carettoni and Mauro Gentile · troopers.de · 27 March 2015

SWF files built with a pre-patch Adobe Flex SDK stay exploitable after the SDK is fixed, because the vulnerable localization code is compiled into the file. A crafted request parameter makes such a SWF run attacker JavaScript in the hosting site's origin, giving same-origin XSS and session or CSRF-token theft; the ParrotNG tool locates affected SWFs at scale.

Record

Document

[TROOPERS15] Luca Carettoni, Mauro Gentile - The old is new, again. CVE20112461 is back

Researcher

Luca Carettoni and Mauro Gentile

Published by

troopers.de

Date

27 March 2015

Format

Recording

Topic

Other

In the archive

• Collected in the 2015 research round

Related sources

• troopers 2015 the old is new again cve 2011 2461 is back Whitepaper

Tags

• xss
• sop-bypass
• flash
• same-origin-policy
• cve
• tooling
• large-scale-scan
• owasp-a01-2021
• owasp-a03-2021

This page is the archive's own catalogue record. The research is the work of Luca Carettoni and Mauro Gentile, first published at the original source. Preserved copies are kept so the citation survives its host; this one was last captured on 11 August 2026.