Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2015-5571
HistorySep 22, 2015 - 10:59 a.m.

CVE-2015-5571

2015-09-2210:59:03
CWE-352
CWE-200
[email protected]
web.nvd.nist.gov
41
cve-2015-5571
adobe flash player
cross-site request forgery
csrf attacks
jsonp
security vulnerability
information disclosure
adobe air
swf file format

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

0.015 Low

EPSS

Percentile

87.1%

JSON

Adobe Flash Player before 18.0.0.241 and 19.x before 19.0.0.185 on Windows and OS X and before 11.2.202.521 on Linux, Adobe AIR before 19.0.0.190, Adobe AIR SDK before 19.0.0.190, and Adobe AIR SDK & Compiler before 19.0.0.190 do not properly restrict the SWF file format, which allows remote attackers to conduct cross-site request forgery (CSRF) attacks against JSONP endpoints, and obtain sensitive information, via a crafted OBJECT element with SWF content satisfying the character-set requirements of a callback API. NOTE: this issue exists because of an incomplete fix for CVE-2014-4671 and CVE-2014-5333.

Affected configurations

NVD
Node
adobeflash_playerRange≤11.2.202.508
AND
linuxlinux_kernel
Node
adobeairRange≤18.0.0.199
OR
adobeair_sdkRange≤18.0.0.199
OR
adobeair_sdk_\&_compilerRange≤18.0.0.180
AND
applemac_os_x
OR
microsoftwindows
Node
adobeflash_playerRange≤13.0.0.289
OR
adobeflash_playerMatch14.0.0.125
OR
adobeflash_playerMatch14.0.0.145
OR
adobeflash_playerMatch14.0.0.176
OR
adobeflash_playerMatch14.0.0.179
OR
adobeflash_playerMatch15.0.0.152
OR
adobeflash_playerMatch15.0.0.167
OR
adobeflash_playerMatch15.0.0.189
OR
adobeflash_playerMatch15.0.0.223
OR
adobeflash_playerMatch15.0.0.239
OR
adobeflash_playerMatch15.0.0.246
OR
adobeflash_playerMatch16.0.0.235
OR
adobeflash_playerMatch16.0.0.257
OR
adobeflash_playerMatch16.0.0.287
OR
adobeflash_playerMatch16.0.0.296
OR
adobeflash_playerMatch17.0.0.134
OR
adobeflash_playerMatch17.0.0.169
OR
adobeflash_playerMatch17.0.0.188
OR
adobeflash_playerMatch17.0.0.190
OR
adobeflash_playerMatch17.0.0.191
OR
adobeflash_playerMatch18.0.0.160
OR
adobeflash_playerMatch18.0.0.194
OR
adobeflash_playerMatch18.0.0.203
OR
adobeflash_playerMatch18.0.0.209
OR
adobeflash_playerMatch18.0.0.232
AND
applemac_os_x
OR
microsoftwindows
Node
adobeairRange≤18.0.0.143
AND
googleandroid

Related

nvd 4
prion 4
cvelist 4
ubuntucve 4
cve 3
nessus 49
osv 1
github 1
checkpoint_advisories 1
nodejs 1
threatpost 1
symfony 1
redhat 3
suse 10
kaspersky 3
openvas 22
altlinux 4
gentoo 2
mageia 3
archlinux 1
freebsd 2
nvd
nvd
CVE-2015-5571
2015-09-22 10:59:03
CVE-2014-5333
2014-08-19 11:16:59
CVE-2014-4671
2014-07-09 05:04:24
prion
prion
Cross site request forgery (csrf)
2015-09-22 10:59:00
Cross site request forgery (csrf)
2014-08-19 11:16:00
Cross site request forgery (csrf)
2014-07-09 05:04:00
cvelist
cvelist
CVE-2015-5571
2015-09-22 10:00:00
CVE-2014-5333
2014-08-19 10:00:00
CVE-2014-4671
2014-07-09 01:00:00
ubuntucve
ubuntucve
CVE-2015-5571
2015-09-22 00:00:00
CVE-2014-5333
2014-08-19 00:00:00
CVE-2014-4671
2014-07-09 00:00:00
cve
cve
CVE-2014-5333
2014-08-19 11:16:59
CVE-2014-4671
2014-07-09 05:04:24
CVE-2015-3096
2015-06-10 01:59:39
nessus
nessus
Adobe AIR < 14.0.0.137 Multiple Vulnerabilities (APSB14-17)
2014-07-08 00:00:00
SuSE 11.3 Security Update : flash-player (SAT Patch Number 9508)
2014-07-15 00:00:00
MS KB2974008: Update for Vulnerabilities in Adobe Flash Player in Internet Explorer
2014-07-08 00:00:00
osv
osv
Rosetta-Flash JSONP Vulnerability in hapi
2020-08-31 22:45:35
github
github
Rosetta-Flash JSONP Vulnerability in hapi
2020-08-31 22:45:35
checkpoint_advisories
checkpoint_advisories
Adobe Flash Player JSONP Cross-Site Request Forgery (APSB14-17: CVE-2014-4671)
2014-07-29 00:00:00
nodejs
nodejs
Rosetta-Flash JSONP Vulnerability
2015-10-17 19:41:46
threatpost
threatpost
June 2015 Adobe Flash Player Security Update
2015-06-09 11:39:01
symfony
symfony
Security releases (CVE-2014-4931): Symfony 2.3.18, 2.4.8, and 2.5.2 released
2014-07-15 00:00:00
redhat
redhat
(RHSA-2014:0860) Critical: flash-plugin security update
2014-07-09 00:00:00
(RHSA-2015:1814) Critical: flash-plugin security update
2015-09-22 00:00:00
(RHSA-2014:1051) Critical: flash-plugin security update
2014-08-13 00:00:00
suse
suse
flash-player (critical)
2014-07-17 09:04:16
flash-player (critical)
2014-07-16 12:04:13
Security update for flash-player (critical)
2014-07-15 07:04:19
kaspersky
kaspersky
KLA10036 Multiple vulnerabilities in Adobe Flash and Adobe AIR
2014-07-08 00:00:00
KLA10670 Multiple vulnerabilities in Adobe products
2015-09-21 00:00:00
KLA10671 Flash Player update for Google Chrome
2015-09-21 00:00:00
openvas
openvas
Adobe Flash Player Multiple Vulnerabilities-01 (Jul 2014) - Windows
2014-07-11 00:00:00
Mageia: Security Advisory (MGASA-2014-0291)
2022-01-28 00:00:00
Adobe Flash Player Multiple Vulnerabilities-01 (Jul 2014) - Linux
2014-07-11 00:00:00
altlinux
altlinux
Security fix for the ALT Linux 6 package adobe-flash-player version 3:11-alt31
2014-07-16 00:00:00
Security fix for the ALT Linux 7 package adobe-flash-player version 3:11-alt31
2014-07-16 00:00:00
Security fix for the ALT Linux 7 package adobe-flash-player version 3:11-alt53
2015-09-25 00:00:00
gentoo
gentoo
Adobe Flash Player: Multiple vulnerabilities
2014-07-09 00:00:00
Adobe Flash Player: Multiple vulnerabilities
2015-09-25 00:00:00
mageia
mageia
Updated flash-player-plugin packages fix multiple vulnerabilities
2014-07-10 03:21:32
Updated flash-player-plugin packages fix security vulnerabilities
2015-09-22 00:07:00
Updated flash-player-plugin package fixes security vulnerability
2015-06-24 08:58:28
archlinux
archlinux
flashplugin: multiple issues
2015-09-22 00:00:00
freebsd
freebsd
flash -- multiple vulnerabilities
2015-09-21 00:00:00
Adobe Flash Player -- critical vulnerabilities
2015-06-09 00:00:00

4.3 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

6.8 Medium

AI Score

Confidence

Low

0.015 Low

EPSS

Percentile

87.1%

JSON
Related for CVE-2015-5571
nvd4prion4cvelist4ubuntucve4cve3nessus49osv1github1checkpoint_advisories1nodejs1threatpost1symfony1redhat3suse10kaspersky3openvas22altlinux4gentoo2mageia3archlinux1freebsd2