FKIE_CVE-2008-4401
Vulnerability from fkie_nvd - Published: 2008-10-17 19:31 - Updated: 2025-04-09 00:30
Severity ?
Summary
ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file.
References
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| adobe | flash_player | * | |
| adobe | flash_player | 7.0 | |
| adobe | flash_player | 7.0.1 | |
| adobe | flash_player | 7.0.25 | |
| adobe | flash_player | 7.0.63 | |
| adobe | flash_player | 7.0.69.0 | |
| adobe | flash_player | 7.0.70.0 | |
| adobe | flash_player | 7.0_r67 | |
| adobe | flash_player | 7.1 | |
| adobe | flash_player | 7.1.1 | |
| adobe | flash_player | 7.2 | |
| adobe | flash_player | 8.0 | |
| adobe | flash_player | 8.0.24.0 | |
| adobe | flash_player | 8.0.34.0 | |
| adobe | flash_player | 8.0.35.0 | |
| adobe | flash_player | 8.0.39.0 | |
| adobe | flash_player | 9.0 | |
| adobe | flash_player | 9.0.112.0 | |
| adobe | flash_player | 9.0.114.0 | |
| adobe | flash_player | 9.0.115.0 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:adobe:flash_player:*:*:*:*:*:*:*:*",
"matchCriteriaId": "CE43678F-7BFF-43EF-8968-B440E2BEF76F",
"versionEndIncluding": "9.0.124.0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DDFF4A51-C936-4C5B-8276-FD454C9E4F40",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:7.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D5ECC9D7-3386-4FEA-9218-91E31FF90F3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:7.0.25:*:*:*:*:*:*:*",
"matchCriteriaId": "F0E93289-6EE0-401A-958D-F59D2CDAE2F1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:7.0.63:*:*:*:*:*:*:*",
"matchCriteriaId": "0FA3E556-BF8F-4D30-8DE5-09DA3FD8D5C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:7.0.69.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A82D5B56-44E0-4120-B73E-0A1155AF4B05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:7.0.70.0:*:*:*:*:*:*:*",
"matchCriteriaId": "8E895107-ED8A-4F88-87C3-935EAE299C01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:7.0_r67:*:*:*:*:*:*:*",
"matchCriteriaId": "7AB20235-B2F2-426E-B797-BFA361CEC488",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "4007D621-A0BC-4927-82A7-10D73802BCF8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:7.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "641776AE-5408-439E-8290-DD9324771874",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "138A932A-D775-46A2-86EC-3C03C96884C4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D12E3957-D7B2-4F3B-BB64-8B50B8958DEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:8.0.24.0:*:*:*:*:*:*:*",
"matchCriteriaId": "32912721-F750-4C20-B999-E728F7D3A85D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:8.0.34.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A95FA639-346C-491C-81A8-6C2A7B01AA19",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:8.0.35.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C9F1E5AB-DEFA-42FC-A299-C8EEB778F9C6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:8.0.39.0:*:*:*:*:*:*:*",
"matchCriteriaId": "FC7DD938-F963-4E03-B66B-F00436E4EA9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:9.0:*:*:*:*:*:*:*",
"matchCriteriaId": "B2A0777F-22C2-4FD5-BE81-8982BE6874D2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:9.0.112.0:*:*:*:*:*:*:*",
"matchCriteriaId": "7AE89894-E492-4380-8A2B-4CDD3A15667A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:9.0.114.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1C6ED706-BAF2-4795-B597-6F7EE8CA8911",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:adobe:flash_player:9.0.115.0:*:*:*:*:*:*:*",
"matchCriteriaId": "260E2CF6-4D15-4168-A933-3EC52D8F93FF",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "ActionScript in Adobe Flash Player 9.0.124.0 and earlier does not require user interaction in conjunction with (1) the FileReference.browse operation in the FileReference upload API or (2) the FileReference.download operation in the FileReference download API, which allows remote attackers to create a browse dialog box, and possibly have unspecified other impact, via an SWF file."
},
{
"lang": "es",
"value": "ActionScript en Adobe Flash Player 9.0.124.0 y anteriores no requiere interacci\u00f3n del usuario en conjunci\u00f3n con (1) la operaci\u00f3n FileReference.browse en la API de subida FileReference upload o (2) la operaci\u00f3n FileReference.download en la API de descarga FileReference, lo que permite a atacantes remotos crear un cuadro de di\u00e1logo de exploraci\u00f3n y ,posiblemente tener otro impacto no especificado, mediante un fichero SWF."
}
],
"id": "CVE-2008-4401",
"lastModified": "2025-04-09T00:30:58.490",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "COMPLETE",
"baseScore": 10.0,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "COMPLETE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 10.0,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2008-10-17T19:31:15.073",
"references": [
{
"source": "cve@mitre.org",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/32270"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/32448"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/32702"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/32759"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/33390"
},
{
"source": "cve@mitre.org",
"url": "http://secunia.com/advisories/34226"
},
{
"source": "cve@mitre.org",
"url": "http://security.gentoo.org/glsa/glsa-200903-23.xml"
},
{
"source": "cve@mitre.org",
"url": "http://securitytracker.com/id?1021061"
},
{
"source": "cve@mitre.org",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1"
},
{
"source": "cve@mitre.org",
"url": "http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm"
},
{
"source": "cve@mitre.org",
"url": "http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm"
},
{
"source": "cve@mitre.org",
"url": "http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html"
},
{
"source": "cve@mitre.org",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb08-18.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.redhat.com/support/errata/RHSA-2008-0945.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.redhat.com/support/errata/RHSA-2008-0980.html"
},
{
"source": "cve@mitre.org",
"url": "http://www.vupen.com/english/advisories/2008/2838"
},
{
"source": "cve@mitre.org",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45913"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2008-11/msg00001.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/32270"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/32448"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/32702"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/32759"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/33390"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/34226"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://security.gentoo.org/glsa/glsa-200903-23.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://securitytracker.com/id?1021061"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://sunsolve.sun.com/search/document.do?assetkey=1-26-248586-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://support.avaya.com/elmodocs2/security/ASA-2008-440.htm"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://support.avaya.com/elmodocs2/security/ASA-2009-020.htm"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.adobe.com/devnet/flashplayer/articles/fplayer10_security_changes.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "http://www.adobe.com/support/security/bulletins/apsb08-18.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.redhat.com/support/errata/RHSA-2008-0945.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.redhat.com/support/errata/RHSA-2008-0980.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.vupen.com/english/advisories/2008/2838"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/45913"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-264"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…