XSS vulnerability with swfupload

[giorgino]

I've just read this:
http://mondoeventi.com/xss-vulnerab...-dotclear-xenforo-instantcms-aionweb-dolphin/

What do you think about it?

 

[MattW]

I've just read this:
http://mondoeventi.com/xss-vulnerab...-dotclear-xenforo-instantcms-aionweb-dolphin/

What do you think about it?

What about it? It was fixed in the last release:

Vulnerable are versions XenForo 1.0.0 - 1.1.2. In XenForo 1.1.3 this
vulnerability was fixed and patch was released for previous versions
(already at 19.06.2012).

 

[giorgino]

Oops thank you

 

[tenants]

It was also mentioned in your post a few times, with links to the fix (this is one of the reasons many people were asking if you had updated to 1.3)

http://xenforo.com/community/threads/xenforo-hacked.42334/#post-456401
http://xenforo.com/community/threads/xenforo-security-fix-for-1-0-0-1-1-2.32890/#post-375821
http://xenforo.com/community/threads/xenforo-hacked.42334/page-2#post-456463