Lucene search

MitreCVE-2008-4401

HistoryOct 17, 2008 - 7:31 p.m.

CVE-2008-4401

2008-10-1719:31:15

CWE-264

mitre

web.nvd.nist.gov

adobe flash player

cve-2008-4401

actionscript

filereference.browse

filereference.download

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

AI Score

6.8

Confidence

Low

EPSS

0.033

Percentile

91.3%

JSON

ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file.

Affected configurations

Nvd

Node

adobeflash_playerRange≤9.0.124.0

adobeflash_playerMatch7.0

adobeflash_playerMatch7.0.1

adobeflash_playerMatch7.0.25

adobeflash_playerMatch7.0.63

adobeflash_playerMatch7.0.69.0

adobeflash_playerMatch7.0.70.0

adobeflash_playerMatch7.0_r67

adobeflash_playerMatch7.1

adobeflash_playerMatch7.1.1

adobeflash_playerMatch7.2

adobeflash_playerMatch8.0

adobeflash_playerMatch8.0.24.0

adobeflash_playerMatch8.0.34.0

adobeflash_playerMatch8.0.35.0

adobeflash_playerMatch8.0.39.0

adobeflash_playerMatch9.0

adobeflash_playerMatch9.0.112.0

adobeflash_playerMatch9.0.114.0

adobeflash_playerMatch9.0.115.0

VendorProductVersionCPE
adobeflash_player7.0cpe:/a:adobe:flash_player:7.0:::
adobeflash_player7.0.70.0cpe:/a:adobe:flash_player:7.0.70.0:::
adobeflash_player8.0.39.0cpe:/a:adobe:flash_player:8.0.39.0:::
adobeflash_player7.0.69.0cpe:/a:adobe:flash_player:7.0.69.0:::
adobeflash_playercpe:/a:adobe:flash_player::::
adobeflash_player9.0.114.0cpe:/a:adobe:flash_player:9.0.114.0:::
adobeflash_player7.2cpe:/a:adobe:flash_player:7.2:::
adobeflash_player9.0.112.0cpe:/a:adobe:flash_player:9.0.112.0:::
adobeflash_player7.0.63cpe:/a:adobe:flash_player:7.0.63:::
adobeflash_player7.0.1cpe:/a:adobe:flash_player:7.0.1:::

Vendor	Product	Version	CPE
adobe	flash_player	7.0	cpe:/a:adobe:flash_player:7.0:::
adobe	flash_player	7.0.70.0	cpe:/a:adobe:flash_player:7.0.70.0:::
adobe	flash_player	8.0.39.0	cpe:/a:adobe:flash_player:8.0.39.0:::
adobe	flash_player	7.0.69.0	cpe:/a:adobe:flash_player:7.0.69.0:::
adobe	flash_player		cpe:/a:adobe:flash_player::::
adobe	flash_player	9.0.114.0	cpe:/a:adobe:flash_player:9.0.114.0:::
adobe	flash_player	7.2	cpe:/a:adobe:flash_player:7.2:::
adobe	flash_player	9.0.112.0	cpe:/a:adobe:flash_player:9.0.112.0:::
adobe	flash_player	7.0.63	cpe:/a:adobe:flash_player:7.0.63:::
adobe	flash_player	7.0.1	cpe:/a:adobe:flash_player:7.0.1:::